Add SARIF output for GitHub code scanning

[BLCCoreStudio]

Goal

Add an opt-in SARIF output path so AgentContextMap findings can be consumed by GitHub code scanning without overstating what deterministic instruction analysis can prove.

Acceptance criteria

• add a documented SARIF output mode or output path
• use stable rule IDs for AgentContextMap finding classes
• attach findings to the relevant repository instruction source locations where possible
• map severity conservatively and document the mapping
• preserve current text, JSON, HTML, and --fail-on-conflict behavior
• write only the explicitly requested output file; no repository mutation
• add fixture/integration coverage for representative findings
• document a minimal github/codeql-action/upload-sarif workflow example
• keep deterministic-analysis and false-positive limitations explicit

Non-goals

• claiming LLM-level semantic understanding
• executing repository instructions
• remote scanning or repository uploads by AgentContextMap itself

This corresponds to the existing README roadmap item for SARIF / GitHub code-scanning output.