fix(cli): apply [[overrides]] to plugin findings (CD-321)

[TAJD]

Fixes CD-321.

[[overrides]] with disabled = true had no effect on plugin-produced findings, while the identical syntax in the same file silenced a built-in check. No error, no warning. Escalating the glob from plugins/*/fixtures/** to **/fixtures/** to ** changed nothing at any step — the documented escape hatch was simply unavailable for plugin checks.

Root cause

Override resolution lives in Engine::effective_options / effective_severity, called from inside the engine's self.checks loop. Plugin checks never enter that loop: they run through the Node host in crates/cofferdam-cli/src/plugins.rs, entirely outside the engine.

Fix

A new plugin_override_verdict in cofferdam-cli/src/main.rs mirrors those two methods' last-match-wins semantics over the same cfg::OverrideBlock list, applied to plugin issues in run_plugins_filtered — the single point both cofferdam check and cofferdam verify --dist funnel through. Disabled matches are dropped; severity matches are stamped on.

Post-filtering on the Rust side rather than pre-invocation: pushing override state into the host would be a wire-protocol change, and a plugin check can be enabled on some paths and disabled on others, so the host has to run for the file set regardless. No change to the wire protocol, the Check trait, or the Node host.

Also fixed, and not fixed

• severity overrides now reach plugin issues. They did not before — a plugin's own defaultSeverity was the only source of truth, and neither a global nor a per-path severity override touched it.
• options overrides still do not. The host receives the global cfg.checks bag once per run in the header record, so per-path resolution needs either one invocation per distinct option set or a protocol change. Filed as CD-326, deliberately not smuggled in here.
• [[context_suppress]] is unaffected — it filters Context.* digest items from cofferdam context, not check findings.

Tests

crates/cofferdam-cli/tests/plugin_overrides.rs, four end-to-end cases against a fixture plugin that flags unconditionally: paths = ["**"] silences it entirely; a narrow glob disables it for the matching path and leaves the other reporting; a severity override replaces the plugin's own defaultSeverity; no override at all still reports. Modelled on the existing plugin_suppression_relative_path.rs harness, and skipping when node is absent, per the existing convention.

Verification

cargo build --workspace, cargo test --workspace (1379 passed, 8 ignored), cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all -- --check — all green.

🤖 Generated with Claude Code

https://claude.ai/code/session_019afugU2bTYCtXn6Vy9dn1v