sast-driven

The SAST-driven find mode — a fourth, deliberately ISOLATED pass alongside blind / threat-model / CVE-seeded. Runs every static-analysis engine with its DEFAULT rules out of the box (OpenGrep + upstream rule packs, clippy with all groups, dylint, cargo-audit, cargo-geiger, ast-grep enumerators) inside the vuln-pipeline-sast container, filters and clusters the output into CELLS, and hands them to the existing /triage…