feat(fusion): Phase 13 — two-panel fusion adjudication

OpenUltraCode-style deepening for findings that need more reasoning than the
ranker→hunter→verifier→mapping loop provides.

- fusion.py (zero-dep core + lazy LLM path): a deterministic trigger policy
  (critical/high severity, verifier disagreement, static-vs-semantic conflict,
  gates-risky-fix, high-assurance request); two panels that steel-man the
  vulnerability and false-positive cases; a deterministic, auditable decider that
  reconciles to one of five dispositions (accepted/rejected/mitigated/deferred/
  blocked); full disclosure (votes, model IDs, degradations, warnings, decision
  source). fuse_findings_dispatch routes panels through the configured HarnessX
  provider when panel_model + extra are present, else deterministic + a degradation.
- config [fusion]: enabled (default true), panel_model, decider_model,
  high_assurance.
- cli: standard-mode fusion stage runs on triggered findings, writes fusion.json
  and a manifest `fusion` block; quick mode never fuses. reports.write_manifest
  gained the fusion summary param.
- 8.4 zero-dep guard extended to cover fusion.py (lazy harnessx import only).
- README fusion section marked implemented + documented; openrouter-sast-harness
  Phase 13 checked off.

tests/test_fusion.py (16 tests) + config tests. 169 passed, 4 skipped; ruff + mypy
clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/config.py

@@ -77,6 +77,17 @@ class HarnessxConfig:
     token_threshold: int = 120_000
 
 
+@dataclass(frozen=True)
+class FusionConfig:
+    # Two-panel fusion adjudication for triggered findings (standard mode). Runs
+    # deterministically by default; setting panel_model routes the panels through
+    # the configured HarnessX provider. high_assurance forces fusion on every finding.
+    enabled: bool = True
+    panel_model: str | None = None
+    decider_model: str | None = None
+    high_assurance: bool = False
+
+
 @dataclass(frozen=True)
 class ResolvedConfig:
     models: ModelConfig = ModelConfig()
@@ -88,6 +99,7 @@ class ResolvedConfig:
     score: ScoreConfig = ScoreConfig()
     ruleset: RulesetConfig = RulesetConfig()
     harnessx: HarnessxConfig = HarnessxConfig()
+    fusion: FusionConfig = FusionConfig()
     runs_dir: str = ".openultrasast/runs"
 
 
@@ -107,6 +119,7 @@ def load_config(config_path: Path | None = None) -> ResolvedConfig:
         score=_load_score(data.get("score", {})),
         ruleset=_load_ruleset_config(data.get("ruleset", {})),
         harnessx=_load_harnessx(data.get("harnessx", {})),
+        fusion=_load_fusion(data.get("fusion", {})),
         runs_dir=os.environ.get("OPENULTRASAST_RUNS_DIR", ".openultrasast/runs"),
     )
 
@@ -210,6 +223,16 @@ def _load_harnessx(value: object) -> HarnessxConfig:
     )
 
 
+def _load_fusion(value: object) -> FusionConfig:
+    data = _section(value)
+    return FusionConfig(
+        enabled=bool(data.get("enabled", True)),
+        panel_model=_string(data.get("panel_model")),
+        decider_model=_string(data.get("decider_model")),
+        high_assurance=bool(data.get("high_assurance", False)),
+    )
+
+
 def _float_value(value: object, default: float) -> float:
     if isinstance(value, bool):
         return default