feat(core): assemble normalized runs, fingerprints, and gate outcomes

[back1ash]

Summary

Combine validator diagnostics and Agent rule findings into result-schema v1 runs with stable identities and gate outcomes.

Scope

• Create finding fingerprints from the documented RFC 8785 projection.
• Apply canonical finding, terminal error, evidence, risk, and gate-cause ordering.
• Calculate the normalized result digest and summary counts.
• Evaluate pass, advisory, blocked, input-error, and internal-error states.
• Attach exact core, validator, rule-pack, runtime, config, and input provenance.

Acceptance criteria

• Every emitted run validates against result schema 1.0.0.
• Default failOn: high blocks High findings and keeps Medium findings advisory.
• Repeated identical inputs produce byte-equivalent canonical results.
• Input and internal failures cannot appear as completed successful runs.
• Summary counts and gate causes are checked semantically, not only structurally.

Dependencies

• feat(core): define the P0 scan configuration contract #19
• feat(core): implement the supervised openapi-spec-validator worker #21
• feat(rulepack): implement the five P0 agent contract rules #23

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Console, Markdown, SARIF, or web presentation.
• Persistence, transport protocols, baselines, or suppressions.