feat(learning-harness): family detectors, verifiers and tags in a scan

Task 3.4. A standard scan now classifies each hotspot region and runs the
detectors of every admitted family plus the generalist, reading the
configurations round zero wrote. A scan never creates them: a missing directory
is a recorded reason and the stage is skipped, which is also what happens when
no chat endpoint resolves.

Every claim passes through its family's verifier and carries what produced it:
the family, the detector version and what the verifier said. Nothing rises above
suspicion here, because the verifier writes a tag and the evidence ladder
belongs to another boundary. Reports gain a section naming the three, SARIF
gains the matching properties, and the manifest gains a learning block with the
taxonomy version, the per-family counts, the classifier report and the round.

The feature is off unless a project turns it on, so an existing scan is
unchanged, and all three gate outputs stay byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/config.py

@@ -141,6 +141,7 @@ class VariantsConfig:
 @dataclass(frozen=True)
 class LearningConfig:
     # learning-harness: the classified detector set and its rounds.
+    enabled: bool = False  # off until round zero has written the family configurations this reads
     families_path: str | None = None  # taxonomy file; the shipped ruleset when unset
     configs_dir: str = ".openultrasast/learning/configs"
     k_runs: int = 5  # runs per pair; a single run misses most real changes
@@ -381,6 +382,7 @@ def _load_variants(value: object) -> VariantsConfig:
 def _load_learning(value: object) -> LearningConfig:
     data = _section(value)
     return LearningConfig(
+        enabled=bool(data.get("enabled", LearningConfig.enabled)),
         families_path=_string(data.get("families_path")),
         configs_dir=_string(data.get("configs_dir")) or LearningConfig.configs_dir,
         k_runs=_int_value(data.get("k_runs"), LearningConfig.k_runs),