feat(corpus-seeded-mechanisms): variant findings in MAP, sandbox-eligible, counted in the manifest

Task 2.3 (Req 3.4, 3.5, 3.6, 6.2).

- [variants] enabled / max_mechanisms config; MAP runs variant search
  after the overlay in standard and deep scans only, appends the variant
  findings, rewrites overlay.json with merged ids, and the manifest
  records mechanisms_searched, files_searched, findings and
  merged_into_overlay.
- REGRESS: variant findings join the candidate list after the promotions
  as zero-score hotspots, under the existing safety check and cap.
- Spec notes for group 2 and the design synced (variant_search.py,
  seed.py, derive_shape signature).

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/reports.py

@@ -174,6 +174,7 @@ def write_manifest(
     complexity: dict[str, object] | None = None,
     worth_fixing: dict[str, object] | None = None,
     provenance: dict[str, object] | None = None,
+    variants: dict[str, object] | None = None,
 ) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     verification_by_id = _verification_by_id(verifications)
@@ -210,6 +211,8 @@ def write_manifest(
         payload["worth_fixing"] = worth_fixing
     if provenance is not None:
         payload["provenance"] = provenance
+    if variants is not None:
+        payload["variants"] = variants
     path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n")