Standards family severity model: severity-in-tag rules, grading cascade, candidate gaps

[vircung]

Implements the family-wide severity model designed in
docs/specs/2026-07-22-standards-severity-model-design.md (10-task plan,
subagent-driven; final whole-branch review: Ready to merge).

What changed

• Rule tags carry severity — every rule in both Standards plugins is
  tagged (id: <rule-id>; severity: ...; [kind: defect|hardening;] source: ...); the tag is the single source of truth, all
  ## Review severities roll-up sections are removed.
• Sub-rules — dot-suffixed ids (group.suffix) with absolute
  severities for violations that grade differently from the group
  default; mutually exclusive by wording.
• Kind facet — every critical rule states defect (runtime/live
  risk) or hardening (house-mandated protection); review headlines
  break critical counts down by kind.
• Grading cascade in both code-review skills: sub-rule match → group
  default → rule: none graded by the authoring rubric; specific-id
  citation mandatory; invented ids banned.
• Candidate-gap offers — rule: none findings surface as candidate
  standards gaps with Project-memory park and upstream-report offers.
• Working-process review-reports contract 0.11.0 — finding-citation
  grammar, candidate-gap offers, mixed-version degradation; the
  authoring rubric is canonical in .claude/rules/standards-rule-tags.md
  with exactly three sanctioned verbatim copies.
• Version bumps: working-process 0.11.0, salesforce-standards 0.2.0,
  python-standards 0.2.0.

Validated by dogfooding on six real projects (3 Python + 3 Salesforce,
7 review runs): tag-bound grading held across reruns, zero fabricated
ids, kind labels 100% tag-consistent; residual edge cases are parked
for the next iteration.

Refs #6
Closes #7
Closes #8