feat: native baseline files, Coverage report line, scanner-error diagnostics

[segraef]

What

Third slice of the deployment-gate plan: accepted findings stop re-blocking, and the report says what was actually parsed.

• Native baseline files, no SecKit format. gitleaks ignore files now load from the scanned repo (--gitleaks-ignore-path), .trufflehog-exclude and .checkov.baseline are passed automatically when present at the repo root. Reasons/expiry live in each tool's own format, reviewed in the PR that edits the file.
• Coverage: line (terminal + report) per repo, lifted from osv's Scanned <file> ... found N package(s) output. Handles the singular 1 package form, paths with spaces, and prints no package manifests parsed when osv found nothing - silence never masquerades as coverage.
• Scanner-error diagnostics. trufflehog --fail exits 183 on findings; any other non-zero is a tool error (e.g. a bad regex in .trufflehog-exclude) and now surfaces the stderr tail instead of an unexplained red.
• Docs: coverage matrix, blind-spot list, and two tool caveats verified against the shipped binaries: osv-scanner.toml only loads beside each manifest (a root-level file does nothing for nested lockfiles), and checkov baselines match resource name + check id across files, so same-named resources inherit suppressions.

Verified

• bash check.sh green (shellcheck, PSScriptAnalyzer, YAML).
• checkov baseline end-to-end: failing Dockerfile repo -> exit 1; after --create-baseline -> exit 0 (both shells).
• trufflehog: valid exclude -> clean; invalid regex -> red with trufflehog error (exit 1): + reason.
• Coverage regex units: singular/plural, space paths, empty-log fallback (both shells).
• gitleaks ignore-path flag on a real monorepo: clean, both shells.
• Adversarial review workflow (3 lenses, every finding re-verified by offline reproduction); 9 confirmed findings fixed before commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B9sELo4AqzS2NcvToDhdNy