Add a byte budget to audit SARIF output

[Widthdom]

Summary

Audit SARIF is a potentially large single JSON document but rejects --max-json-bytes.

Audit IDs: P-11. Reproduced with locally built cdidx v1.40.3 at 404db09489c305f17d94f37026e00564d3ac527a.

Existing issue relationship

Follow-up to closed #4715 and #4585's SARIF/bounded-output work.

Expected behavior and PR scope

Support an explicit UTF-8 byte budget while guaranteeing either complete schema-valid SARIF or a machine-readable minimum-budget/truncation strategy—never invalid partial JSON. Keep this SARIF-specific.

Implementation guide for Codex 5.6 sol xhigh

• Decide whether to omit whole results with run properties/continuation or preflight-fail when the required document cannot fit.
• Measure final UTF-8 bytes including escaping/schema boilerplate before commit.
• Reuse completion metadata vocabulary from ad-hoc/audit SARIF and preserve locations/rules.
• Cover exact boundaries, one oversized result, Unicode, empty/multi-run, stdout files, and replay.
• Add focused regression/contract tests, run the full net8.0 and net9.0 suite, and add the required bilingual changelog.d/unreleased/ fragment.

Acceptance criteria

• Output never becomes syntactically invalid SARIF.
• Omitted results are machine-detectable and recoverable where supported.
• Help/completions document the option and minimum behavior.

[Widthdom]

Work started on branch fix-issue4903. I’ll keep the implementation scoped to SARIF audit output byte budgeting, including bounded schema-valid output, help/completions, focused regression tests, and a bilingual changelog fragment.