test(core): prove deterministic CLI and cross-platform parity

[back1ash]

Summary

Use the labeled corpus and golden results to prove repeatability and platform parity for the complete local product path.

Scope

• Run the full corpus repeatedly on Windows, macOS, and Linux.
• Compare normalized JSON bytes, digests, finding identities, ordering, and exit codes.
• Cover OAS 3.0 or 3.1, JSON or YAML, and repository-local references.
• Add regression cases for timeouts, diagnostic floods, invalid input, and dependency failure.
• Publish compact CI summaries and retain decision-grade failure evidence.

Acceptance criteria

• Identical pinned inputs produce byte-equivalent normalized results on every platform.
• Every labeled operation has the expected order-independent findings.
• Bad input, blocked policy, and internal failure use distinct expected exit codes.
• The supported first scan completes within the agreed five-minute smoke budget.
• Any accepted platform difference is explicit and does not alter normalized findings.

Dependencies

• test(rulepack): build a labeled OAS 3.0/3.1 corpus #11
• feat(cli): implement the scan command and stable exit codes #25
• feat(cli): add console and stable JSON reporters #26

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Validator candidate benchmarking or hosted GitHub parity.
• Performance claims beyond the alpha smoke budget.