Runtime evidence at the developer stage: CLI, SARIF and CI gate #80

Part of #51. Secfoo's goal is to cut security impact at the developer stage. Runtime evidence matters most when it changes what gets fixed first, in the branch or PR that's being worked on now, not only on a dashboard after release.

With the same Secfoo API key used for secfoo run and the sensor (#66), the CLI pulls the runtime state back for every finding it shows.

secfoo findings list / show: add a Runtime column. It's fetched from GET /api/runtime/v1/evidence (#66) and cached locally for offline use:

• Reached via E1 (B1): route, anonymous or authenticated (Attribute runtime hits to live traffic (route, auth state) #69, Correlate live traffic with the threat model's entry points #70)
• Reached: route and hit count
• Executed
• Loaded: at the version that's running, with version drift flagged (Runtime package inventory: loaded versions, drift and live advisories #68)
• Not observed: with coverage and window, e.g. "Not observed · 74% · 6h"
• No runtime data: no sensor deployed, or offline. This is the normal state, not an error.

Ordering: sort by runtime state within each severity: reached via exposed entry point, then reached, executed, loaded, no data, not observed. Never hide Not observed findings (rule 4 in #51). --no-runtime skips the fetch.

After secfoo run: when runtime data exists for the project, the summary adds one line, e.g. "3 of 12 findings are reached in production: D2 (POST /upload, anonymous), …".

SARIF (#46): add properties.secfoo.runtime to each result (state, routes, last seen), so PR annotations can say "reached in production via POST /upload". --runtime-priority raises level for reached findings.

CI gate: secfoo findings check --fail-on reached[:<min-severity>] exits with a distinct, documented code when an open finding at that severity is reached in production. Teams can block a release until it's fixed. It's off by default.

Remediation hint: for an SCA finding that is reached, the recommendation names the fixed version and the live routes it protects.

Where to look: the findings commands in src/secfoo/cli.py, the SARIF export from #46, src/secfoo/report/sca.py.

Done when: tests cover every runtime state in the list and the SARIF properties, the gate's exit code, offline mode (cached), no key or no sensor ("No runtime data", no errors, no network call without a key), and --no-runtime.