Tighten CLI parity, monorepo annotations, and workflow noise

[Conalh]

Summary

Bundles four small, related fixes that make v0 more trustworthy and consistent — surfaced by a Cursor review of CapabilityEcho end-to-end. Each is tight and testable; none touches the detection schema or API.

• CLI --fail-on — src/index.ts always returned 0 regardless of findings, so the CLI couldn't gate local pre-commit / non-GHA CI runs. Added --fail-on none|low|medium|high|critical mirroring the Action behavior; returns 1 when rating meets threshold, 2 on invalid input.
• Monorepo path normalization (correctness bug) — src/git-diff.ts normalizeGitDiffPath did lastIndexOf('/src/') etc., which mangled apps/web/src/foo.ts → src/foo.ts and misplaced GitHub annotations onto the wrong file. Git already gives repo-relative paths through b/<path>; stripped the heuristic and kept only b/ + Windows drive normalization.
• Workflow URL gating — src/detectors/workflow-permissions.ts detectExternalCurl flagged any curl/wget/fetch( regardless of URL. Now requires an external https?:// URL or a variable substitution ($VAR / ${{...}}), excluding localhost/127.0.0.1/0.0.0.0/::1. detectSecretExfil is untouched, so secret-adjacent network calls still flag.
• README fixture alignment — README demo bullet referenced src/telemetry/client.ts; the local fixture is at src/api/sync.ts. Aligned the bullet with the actual fixture.

Also deduplicated severityRank — exported once from report.ts and consumed by both action.ts and index.ts.

Why batched

These are all "make v0 trustworthy" fixes (one correctness bug, one parity gap, one false-positive reduction, one docs fix). No API breaks, small surface, obvious tests. Larger items from the same review (Python dep manifests, suppression/baseline, SARIF, PR-comment posting) each warrant their own PR with a design pass — explicitly deferred here.

Test plan

• npm test — 73 passing (was 64; +9 new):
  • CLI: default exits 0 with findings, --fail-on HIGH returns 1, below-threshold returns 0, invalid value returns 2
  • Git diff: monorepo paths apps/web/src/api.ts and packages/core/src/util.ts survive normalization
  • Workflow detector: literal URL flagged, variable URL flagged, localhost skipped, non-network curl mentions skipped
• npm run build — clean tsc + ncc bundle
• Reviewer: confirm --fail-on exit-code semantics match expectations for local pre-commit usage
• Reviewer: spot-check the URL-gating regex against your own workflow corpus for unexpected misses

🤖 Generated with Claude Code