feat: v0.5.47 — x-FuSa spec v1.15.0 adoption + deep-audit bug-fix sprint

[SoundMatt]

Summary

Closes #73, #74, #75, #76, #77, #78, #79. Adopts the actionable parts of #80
(x-FuSa spec v1.15.0).

Fixes found and verified by running cfusa fmea/cfusa tara/cfusa hara/
cfusa sci against c-FuSa's own codebase and diffing real output against
docs/x-fusa-spec.md in FuSaOps (the master spec):

• hara --format json is not a verbatim passthrough of .fusa-hara.json — drops cross-references and attestation #73 hara --format json is now a verbatim passthrough of
  hazards[].source/situations/safetyGoals, safetyGoals[].hazards/safeState,
  and the document attestation — previously silently dropped.
• HARA risk.asil is never cross-checked against the S×E×C table in check's gate or hara --format json #74 Stored risk.asil is now cross-checked against the ISO 26262-3
  Table 4 S×E×C derivation both as a new gating check rule (HARA006) and
  in hara --format json's completeness.asilMismatches — previously only a
  hara show (text) warning line with no effect on any exit code.
• fmea.json / tara.json 'standard' field is a display string, not the canonical lowercase id (§2.4.1) #75 fmea.json/tara.json standard now emits the canonical lowercase
  id (iso26262/iso21434) instead of a citation string.
• tara.json impact.* uses high|medium|low instead of the v1.14.1 closed enum, and risk is an ad hoc score instead of the spec's combination table #76 tara.json impact.* now uses the v1.14.1 closed enum
  (critical|major|moderate|negligible); risk is a literal lookup against
  the spec's combination table instead of an ad hoc score.
• fmea.json/tara.json file paths truncated to basename, and sci.json emits absolute paths (§4 project-relative MUST) #77 fmea/tara/sci file/location.file are project-relative
  (including subdirectory) instead of a bare basename or a leaked absolute
  path, regardless of whether --dir is relative or absolute.
• fmea.json/tara.json content generators pick up stdlib calls and string-literal text as project functions/assets (§1.6 rule 4) #78 fmea/tara no longer pick up standard-library calls or
  string-literal text as project components/assets — 18% of this repo's own
  previously-committed fmea.json was stdlib noise (fprintf/snprintf/...),
  plus a string-literal misparse that produced a "strcpy-prefixed asset name.
• cfusa fmea has no --output <file> flag, contradicting the x-FuSa spec §9.2 CLI synopsis (only --output-dir works) #79 cfusa fmea --output <file> — previously undefined, so
  getopt_long's unambiguous-prefix matching silently treated it as an
  abbreviation of --output-dir.
• Adopt x-FuSa spec v1.15.0: attestation carry-forward MUST + coveragePct clamp #80 point 3: summary.coveragePct defensive clamp on fmea/tara,
  with regression tests using a non-trivial test-source tree fixture.
  Point 2 (reuse test-tree/stdlib exclusion logic): new shared
  cfusa_is_test_source_file()/cfusa_extract_call_name()/
  cfusa_is_stdlib_call() utilities replace three near-duplicate scanners.
  Point 1 (attestation carry-forward MUST): already conformant for
  fmea/tara/safety-case/sas before this PR — only hara's own JSON
  passthrough had a gap, closed by hara --format json is not a verbatim passthrough of .fusa-hara.json — drops cross-references and attestation #73 above.

Bonus fix found while dogfooding

cfusa_walk_sources() only skipped a fixed directory-name enum
(build/vendor/build-cov/node_modules). A local working tree with other
build-type variants side by side (build-asan, build_fortify, ...) had
every one of them scanned as project source too, picking up CMake's own
generated CompilerIdC probe as fake FMEA/TARA entries. Now skips any
build/build-*/build_* directory, matching this repo's own .gitignore.

Also fixed a real bug found while writing tests: cfusa_relativize_path()
deliberately does not call realpath() — since cfusa_walk_sources()
always builds path by literally concatenating the given --dir, resolving
symlinks first can silently break the prefix match (macOS aliases /tmp to
/private/tmp).

Regenerated fmea.json/fmea.csv/tara.json/tara.md/safety-case.json/
safety-case.md against the fixes above (dogfooding, same convention as
v0.5.46).

Test plan

• ctest --test-dir build --output-on-failure — 39/39 passing, including
  13 new regression tests in tests/test_xfusa_v114.c and 2 new
  HARA006 tests in tests/test_safety_rules.c
• cfusa fmea --dir . --strict / cfusa tara --dir . --strict exit 0
  against this repo's own regenerated artifacts
• cfusa trace --dir . --gaps shows the same 5 pre-existing gaps as the
  main baseline (no new untested requirements)
• cfusa check --dir . shows the same 9 pre-existing errors as the
  main baseline (no new findings introduced)
• Local coverage run (cfusa coverage --lcov ... --threshold 80):
  91.4% line coverage, well above the CI gate
• Verified the macOS /tmp symlink relativization case manually and via
  a dedicated regression test

[github-advanced-security]

cfusa found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.