Feedback: SARIF analysis-category drift in v0.4.17

[CAOShurong]

VulnFuse v0.4.17 can now report and optionally gate changes to SARIF run.automationDetails.id categories, including zero-result runs.

This is deliberately a narrow signal. A category change can indicate that two uploads no longer cover the same language, directory, or analysis variant, but VulnFuse cannot prove what a category semantically represents or whether scan coverage is complete.

Useful feedback would be:

• sanitized before/current SARIF pairs where the category changed but finding counts did not;
• workflows that intentionally add or remove categories;
• cases where a missing category should or should not block a baseline comparison;
• export wording that is ambiguous in JSON, SARIF, CSV, HTML, or Markdown.

Please remove repository names, paths, secrets, and proprietary finding text before sharing. A minimal synthetic fixture is welcome.