[SizzleUnrlsd]

Closes #32.

Change

src/findings.cpp only, no change in what the analyzer reports.

• kRules is the one catalogue of the rules ParseFindings reports: id, title, description, confidence.
• kBoundsRules, kVtableRules, the double-free and memory-leak reports and the vtable-diagnostic fallback hold a const CatalogueRule& obtained from RuleNamed("<id>"), a consteval lookup into kRules. OneLineFinding takes a catalogue entry instead of a string.
• DescribeRule reads kRules; its own table is gone.

A rule the parser reports but the catalogue does not describe, or a misspelled id, no longer compiles. The tests in unittests/sarif_test.cpp keep their expected values written out, not read back from the catalogue.

Test first

This is a refactor with a compile-time guarantee, so the red step is a build failure. With RuleNamed("double-free") misspelled as RuleNamed("double-fre"):

src/findings.cpp:400:57: error: call to consteval function '...RuleNamed' is not a constant expression
src/findings.cpp:79:13: note: subexpression not valid in a constant expression
   79 |             throw "rule missing from kRules";

With the ids right, ctest --test-dir build passes 17/17 before and after the change; scripts/format-check.sh is clean on the changed file.

Independent of #34 (which only touches unittests/sarif_test.cpp): either can merge first.