Add canonical dependency finding catalog

[juangaitanv]

Description

Define one ordered, status-aware source of truth for dependency finding codes and use it to hydrate runtime finding metadata.

• Add canonical definitions for the registered DEPnnn codes, including reserved advisory code DEP010.
• Require evaluator findings to resolve through an emitted-only catalog lookup while preserving occurrence context, dynamic recommendations, output schemas, and severity behavior.
• Generate the dependency finding catalog in skills/corgea/SKILL.md from the same source.
• Add catalog, runtime, report, CLI, and generated-skill invariants.

This adds no migration, dependency, environment variable, endpoint, configuration flag, or infrastructure change.

Related Issues

• COR-1559

Type of Change

• Bug fix
• New feature
• Breaking changes
• Tests

Manual Process After Upgrade

• Yes
• No

(If yes) Commands to run:

1. After the corresponding CLI release, submit the exact merged skills/corgea/SKILL.md as a new corgea platform skill version.
2. Confirm that the new platform skill version is approved.
3. Existing users rerun corgea skill install corgea.

Production Safety Checklist

• Requires a new environment variable
• External service dependencies
• Requires the latest Fusion to be deployed first
• Long-running migrations that could lock tables
• Renaming table name/fields
• Deleting data

Documentation Update

Requires Documentation Update:

• Yes
• No

(If yes) Documentation URLs to Update:

Testing

• Unit tests added/updated
• Manual testing completed

Test Results:

• ./harness check --verbose passed all five gates on the final source tree.
• cargo test --lib deps::tests:: passed 98 tests.
• cargo test --test cli_deps passed 31 tests.
• cargo test --test cli_deps_skill passed 2 tests.
• Deterministic human and JSON output, reserved DEP010 absence, generated-skill freshness, and exact --fail-on high exit behavior checks passed.
• git diff --check passed.
• Independent validation returned PASS and QA returned GO with high confidence, no blockers, and no manual verification remaining.