spec(claw): sarif.t27 -- t27c findings as SARIF 2.1.0 for code scanning (row code-scanning-sarif) #10284

Boundary

Touches only specs/claw/sarif.t27 and specs/claw/sarif_pins.t27 (new files, .t27 only). Does not touch any workflow, gate file, seal or generated file. Row code-scanning-sarif of specs/claw/github_surface.t27 (PR #10280, epic #9271).

Scenarios

• A PR changes a spec that no longer parses; t27c prints one finding. Today it is a line in a job log; as a SARIF result it shows in the Security tab and inline on the PR diff, and closes by itself when the next commit fixes it.
• t27c reports nothing; the document is a valid SARIF 2.1.0 run with results: [], so GitHub closes every alert that was open.
• A finding carries a severity word t27c never prints, or a path with ..; the line is dropped and counted, never guessed into a note on line 1.

Requirements

• A spec that shapes findings (one TAB-separated line each: severity, rule slug, path, line, col, message) into a SARIF 2.1.0 document: four stable rule ids, severity mapping error/warning/info(note) to SARIF levels, plain repo-relative paths only, regions clamped to 1, JSON escaping, a result cap.
• Fail closed: unknown severity, unknown rule, bad path or bad number drops the line and sets invocations[0].executionSuccessful to false; a clipped buffer is detectable.
• Tests: severity mapping, unknown severity fails closed, empty input gives a valid empty run, escaping, cap, clipping.
• Length-table pins in a companion test-only spec (the gates_pins.t27 split).

Criteria

• t27c spec-status specs/claw/sarif.t27 prints IMPLEMENTED.
• t27c test-report on both specs: 0 FAIL, 0 vacuous.
• t27c gen-c lowers sarif.t27 (it must be consumable by a harness, like gates.t27).
• The upload wiring (github/codeql-action/upload-sarif with the job's own GITHUB_TOKEN, security-events: write) is a separate step: workflow YAML is foreign code and needs a shrink offset.

Success Criteria

• t27c spec-status specs/claw/sarif.t27 prints IMPLEMENTED and exits 0.
• t27c test-report specs/claw/sarif.t27 specs/claw/sarif_pins.t27 reports 0 FAIL, 0 vacuous and exits 0.
• t27c gen-c specs/claw/sarif.t27 lowers the spec successfully and exits 0.