* feat(model): CWE taxonomy mapping for shell analyzer findings

Closes #364.

Add cwe_for_category() helper that maps FindingCategory to CWE IDs:
- DestructiveBehavior → CWE-1045
- Obfuscation → CWE-454
- DynamicCodeExecution → CWE-94
- CredentialAccess → CWE-798
- Persistence → CWE-506
- PrivilegeEscalation → CWE-269
- NetworkBehavior → CWE-200
- SuspiciousScriptBehavior → CWE-78
- Transport → CWE-918

Applied to all 4 shell detection modules (detection, detection_destructive,
detection_credential, detection_system). 2 new tests verify CWE taxonomy
entries on destructive and credential findings.

The taxonomies field already existed on Finding (with TaxonomyRef/TaxonomyName
types) but was unused by the shell analyzer. The dep-vuln detector already
populated it.

1105 tests pass, 0 clippy warnings.

* refactor(shell): exhaustive CWE match + table-driven mapping test

* refactor(shell): keep only defensible CWE mapping (DynamicCodeExecution)