Emit SARIF so findings show up in the GitHub Security tab

[Dashtid]

A --format sarif option turning each FAIL/MISSING result into a SARIF result would let the gate surface in code scanning. Touches src/subcheck/report.py and src/subcheck/cli.py (format choice). SARIF 2.1.0 minimal profile is enough.