SPDX 3.0.1 Gap - Opaque Metadata in Annotations (3.0.1-Addressable Portion)

[pellecchialuigi]

As per elisa-tech/Safety_Architecture_WG#18 - Gap 4: Opaque Metadata in Annotations (3.0.1-Addressable Portion)

Current: All BASIL-specific metadata is serialized as JSON strings inside Annotation.statement fields with annotationType: "other". This makes the data opaque to any SPDX-aware tooling.

While the full resolution of this issue requires SPDX 3.1-dev safety-specific elements (see spdx_31_functional_safety_gap_analysis.md), some metadata can be moved to proper SPDX 3.0.1 constructs now:

Metadata	Current Location	3.0.1 Target
Requirement ID / title	Annotation JSON	ExternalIdentifier (see Gap 3)
Code section / offset / length	Annotation JSON	Already in software_Snippet byte range properties (redundant)
Coverage percentage	Annotation JSON	Relationship.completeness (complete/incomplete/noAssertion) — already emitted
BASIL internal fields (__tablename__, version)	Annotation JSON	Keep as BASIL-extension annotation, but version the annotation schema

Fix:

1. Move identifiers to ExternalIdentifier (Gap 3)
2. Remove redundant code section data from annotations (already in snippet properties)
3. Add "basil:annotationVersion": "2.0" to remaining annotations so consumers can distinguish old-format from new-format

Note: Requirement status, safety-specific coverage metrics, and lifecycle metadata will be addressed in the SPDX 3.1-dev gap analysis, where proper elements (Requirement with status property, EvaluationResult, RequirementVerification) become available.