[SizzleUnrlsd]

Summary

First item of #68: reports name files relative to what was checked, so the output is stable across machines and code scanning services attach SARIF results to files.

• Acceptance tests first (test: define report paths relative to the checked root), implementation follows.
• Report gains a root: the directory checked, or the directory of the file checked. Report.locate renders a path under the root relative to it, POSIX style, and leaves any other path as it is.
• Text: app/views.py:3:5: …. JSON: relative location.path and coverage paths, plus a top-level root so consumers can rebuild absolute paths. SARIF: the root is declared once as the SRCROOT original URI base and every location under it carries uriBaseId; a location outside the root keeps its absolute URI without a base. Without a root, nothing changes.
• engine.report(findings, coverage, root); the CLI passes the resolved directory or the file's directory.
• Five existing CLI tests that asserted absolute paths now expect the relative form; the usage guide describes the new shape.

Part of #68.