feat: import Endor Labs findings

[mldangelo-oai]

Summary

Adds --provider endor for native Endor Finding JSON and self-contained endorctl SARIF 2.1.0. Both formats retain finding UUIDs and original source evidence through the existing preview, confirmation, checkpoint, and readback flow. Stacked on #1687.

Changes

Maps native SAST and AI SAST paths and primary start lines, preserves reported SARIF lines for code and secret categories, and decodes URI escapes before validating repository paths. Indexed, base-relative, unsafe, or malformed artifact locations remain in the original evidence without an asserted repository path.

For new uploads, declared SARIF repository URLs must match the selected Cloud repository. Saved requests keep their original repository ID and can resume after a repository rename.

Rejects unfinished paginated JSON responses, ambiguous identities, invalid records, and external SARIF property files. Fractional timestamps survive in source evidence while Cloud timestamps use epoch seconds. Missing severity or revision stays unknown; source verdicts remain separate from Codex assessments.

Testing

• 342 focused tests passed, including parent adapters, 500-record synthetic identity cases, native code locations, URI handling, repository binding, and saved-request replay.
• All 14 findings in the published endorctl SARIF example passed source-retention, reader-parity, repeat, and reordered-result checks.
• Types, generated contracts, formatting, builds, pinned Python checks, and nine portable checks passed.
• The package archive passed all 646 entry checks and the installed-package smoke test.
• Both full SDK runs (seed 12345 and randomized seed 3483453911) completed with 5,236 passes, 75 skips, and one installed-hook failure. That failure also reproduces on unchanged main.
• Three fresh native code reviews and an independent verifier found no actionable introduced defects in the final diff.

Hosted CI must qualify this updated head. Live Cloud upload and readback remain separate requirements.

Risk and rollout

Requires compatible Cloud import support. Preserve a stable source key across exports and inspect exclusions before publishing. This does not run validation scans, fetch report URLs, or enable deployment gates.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.