fix(report): filter empty LLM findings and add SARIF rules[] array

[mimran-khan]

Summary

Two SARIF output correctness issues:

1. Empty findings from LLM failures inflate results — When the LLM meta-analyzer fails or returns partial data, findings with empty rule_id or message leak into the SARIF output, producing invalid results that confuse downstream tooling (IDEs, CI integrations).

2. Missing tool.driver.rules[] array — The SARIF 2.1.0 spec recommends rules[] containing reportingDescriptor entries for each rule referenced by results. Many consumers (GitHub Code Scanning, VS Code SARIF Viewer) use this to display rule metadata.

Changes

src/skillspector/sarif_models.py

• Added SarifReportingDescriptor model with id and shortDescription fields
• Added optional rules field to SarifDriver

src/skillspector/nodes/report.py (_build_sarif)

• Filter findings where rule_id or message is falsy before building results
• Collect unique rule IDs during result building
• Generate sorted rules[] array from seen rule IDs

Testing

12 new tests covering:

• Empty/None rule_id filtered
• Empty/None message filtered
• All-empty findings produce zero results
• Valid findings unchanged
• rules[] present with correct id and shortDescription
• Multiple findings for same rule produce single rule entry
• Rules sorted alphabetically by id
• No rules emitted when all findings are empty

Existing 44 tests in test_sarif.py and test_report.py continue to pass.

Fixes #146, Fixes #148