feat(sarif): add redacted code scanning output

[obmakesomething]

What changed

• Added a redacted SARIF 2.1.0 renderer for Env Mapper findings.
• Added env-mapper scan --emit sarif --format json for CLI/code scanning workflows.
• Added GitHub Action sarif-output and output-format: sarif|all support.
• Added action outputs for sarif and sarif_path.
• Documented GitHub upload-sarif usage.
• Added docs/config-graph.md to capture the product direction as a read-only config graph and safe config context layer for AI coding agents, without renaming the package yet.

Why

SARIF puts config drift findings where developers already review code scanning alerts. The config graph doc folds the broader cfggraph/product design into the repo while keeping the current package and action stable.

Validation

• npm test passed, 38/38 with dependencies installed
• npm test passed in a no-dependency checkout, 37 passed and 1 AST-only test skipped
• npm run build passed
• npm run pack:check passed, 36 package entries including src/format-sarif.js and docs/config-graph.md
• git diff --cached --check passed before commit
• CLI SARIF smoke passed: node src/cli.js scan --root test/fixtures/basic --emit sarif --format json
• No-dependency action smoke passed with Markdown + SARIF artifacts and redaction checks

Non-goals

• No full repo/package rename to cfggraph yet.
• No monorepo restructuring.
• No provider adapters.
• No secret value reads or provider mutation.

Risk notes

• SARIF output contains variable names, file paths, lines, detector patterns, and finding metadata. It does not contain secret values, but metadata can still be sensitive and should be treated as internal evidence.

[devloai]

Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔
Please upgrade your plan or buy additional credits from the subscription page.