fix(security): preserve exact finding identity

[Spectorian]

Summary

• derive finding identity from complete analyzer matches before retaining bounded display previews
• select deterministic severity-first representatives while preserving distinct occurrences and source scope
• keep full match content ephemeral across static, YARA, MCP tool-poisoning, and rug-pull findings
• bound public context and evidence surfaces, and report partial analysis when YARA fingerprint work reaches its limit

Validation

• long-prefix collision, exact-duplicate, severity, source-binding, occurrence, and idempotence regressions
• terminal, JSON, Markdown, SARIF, Python, and MCP serialization checks
• branch-wide non-integration/non-provider suite
• Ruff lint, format, targeted mypy, and git diff --check