docs(ci): add code scanning and reviewdog guides

[aram-devdocs]

Fixes #47
Fixes #48

Summary

• add docs/src/ci/github-code-scanning.md with the required flow: run plumb lint --format sarif --output plumb.sarif, then upload with github/codeql-action/upload-sarif@v3
• document security-events: write and keeping SARIF upload running after findings before failing from the captured Plumb exit code
• add docs/src/ci/reviewdog.md plus committed contrib/reviewdog-plumb.yaml that converts real plumb lint --format json output to reviewdog rdjson with jq
• link both CI pages from docs/src/SUMMARY.md

Validation

• Humanizer run: scanned both new CI docs and contrib/reviewdog-plumb.yaml against .agents/skills/humanizer/SKILL.md vocabulary; only important was flagged and rewritten to detail that matters; rerun produced no matches
• Reviewdog config pipeline tested against real plumb lint plumb-fake://hello --format json via the built plumb binary and committed jq transform: produced rdjson with source plumb, 1 diagnostic, path plumb-lint-target, severity WARNING
• git diff --check origin/main...HEAD
• Scope check: changed only docs/src/ci/github-code-scanning.md, docs/src/ci/reviewdog.md, contrib/reviewdog-plumb.yaml, and docs/src/SUMMARY.md

Notes

• No CI workflows, formatter changes, release docs, or Pages docs are included.

[github-actions]

I have everything I need. Let me compile the review.

---

PR #164 — docs(ci): add code scanning and reviewdog guides

Scope: 263 lines added, zero deleted. Pure documentation — docs/src/ci/github-code-scanning.md, docs/src/ci/reviewdog.md, contrib/reviewdog-plumb.yaml, docs/src/SUMMARY.md. No Rust source touched.

Determinism, layering, error handling, test coverage

All N/A — no Rust changes.

Documentation accuracy

Verified correct:

• Exit code claim (reviewdog.md:122): "exits 3 because it found a warning" matches crates/plumb-cli/src/commands/lint.rs:233 (ExitCode::from(3) for warnings-only).
• JSON field names in jq transform (.violations[], .rule_id, .message, .selector, .viewport, .doc_url, .severity) all match the Violation struct in report.rs and the JSON envelope key inserted at plumb-format/src/lib.rs:161.
• Severity serialization: Severity is #[serde(rename_all = "snake_case")], so "error" / "warning" / "info" match the jq comparisons.
• SARIF upload pattern (capture exit code → upload with if: always() → re-fail) is the correct pattern for keeping GitHub Code Scanning results when the lint step fails.

Issues

Warning — reviewdog.md:63:
reviewdog_version: latest is non-deterministic. Users copying this workflow verbatim could get a breaking reviewdog release. Consider pinning to a known-good version (e.g. v0.20.3) with a comment to check releases.

Warning — reviewdog.md:61 and github-code-scanning.md:35:
cargo install --git https://github.com/aram-devdocs/plumb plumb has no --tag or --rev. Every install will track HEAD — fine for early-stage, but creates reproducibility problems. Document the --tag option, or add a note that users should pin.

Nit — reviewdog.md:21:
"plumb-lint-target:1:1" conflates the path string ("plumb-lint-target") with the combined path+line+column display. The actual YAML produces path: "plumb-lint-target" under location.range.start. The colon notation reads as if :1:1 is part of the path value. "attaching each diagnostic to path plumb-lint-target at line 1, column 1" would be clearer.

Humanizer pass

No blocked vocabulary (delve, leverage, seamless, comprehensive, dive in, etc.). The rewrite of "important" → "detail that matters" (github-code-scanning.md:10) is clean. Prose is tight and specific throughout.

---

Verdict: APPROVE