feat(arsenal): add source and supply-chain parsers (#97)

Follow-up to the JSON-scanner parser layer: wire semgrep, gitleaks, trivy and
grype into parseToolOutput so their findings become structured, gate-verifiable
evidence instead of raw text (they were parserStatus:'planned').

- semgrep  (scan --json)          → one finding per rule match; ERROR/WARNING/INFO
                                     mapped to severity; CWE token pulled from
                                     metadata (e.g. "CWE-78: …" → CWE-78); refs → remediation.
- trivy    (fs --format json)     → one finding per package vuln; CVE + CweIDs +
                                     "upgrade <pkg> to <fixed>" remediation.
- grype    (dir:. -o json)        → one finding per match; CVE + package coordinates.
- gitleaks (detect --report json --redact) → one high finding per secret. Defence in
                                     depth: the details are run through redactString()
                                     so a raw secret can NEVER reach a finding / the vault,
                                     even though the adapter already passes --redact.

Broadens the severity map to cover scanner vocabularies (ERROR/WARNING, CRITICAL…
NEGLIGIBLE, moderate) onto the five canonical levels. Flips parserStatus to
'structured' for the four tools. Extends parsers.test.ts + fixtures: field mapping,
the gitleaks redaction guarantee, and the end-to-end gate pass for every new scanner.

Stacked on the parser layer (#42); pairs with the scanner-invocation fix (#40) that
gives these tools the JSON-emitting arg templates. Until #40 lands the parsers simply
degrade to [] (no JSON to parse) — no misbehaviour. Secret scanners beyond gitleaks
and SARIF-style tools remain a follow-up.

Co-authored-by: Pazificateur69 <agagliardi@guardiaschool.fr>

src/arsenal/catalog.ts

@@ -339,7 +339,7 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     outputFormats: ['json', 'sarif'],
     installHint: 'brew install semgrep or pipx install semgrep',
     commandHint: 'semgrep scan --config auto --json .',
-    parserStatus: 'planned',
+    parserStatus: 'structured',
     notes: 'Static analysis backbone for repository hardening.',
   },
   {
@@ -355,7 +355,7 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     outputFormats: ['json', 'sarif'],
     installHint: 'brew install gitleaks',
     commandHint: 'gitleaks detect --source . --report-format json --redact',
-    parserStatus: 'planned',
+    parserStatus: 'structured',
     notes: 'Secret detection must redact values before ledger insertion.',
   },
   {
@@ -387,7 +387,7 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     outputFormats: ['json', 'sarif'],
     installHint: 'brew install aquasecurity/trivy/trivy',
     commandHint: 'trivy fs --format json .',
-    parserStatus: 'planned',
+    parserStatus: 'structured',
     notes: 'Vulnerability and IaC scanner for repos and images.',
   },
   {
@@ -419,7 +419,7 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     outputFormats: ['json'],
     installHint: 'brew install grype',
     commandHint: 'grype dir:. -o json',
-    parserStatus: 'planned',
+    parserStatus: 'structured',
     notes: 'Pairs well with Syft SBOMs for dependency vulnerability triage.',
   },
   {