feat(SIG-107): add high-impact runner tool wrappers

[damartinezjulio]

What changed

Adds one larger SIG-107 runner batch for CodeRabbit-parity/high-impact language tools:

• Buf for Protobuf, with pinned binary SHA256 verification and SARIF conversion.
• SQLFluff, Prisma Lint, RuboCop, PHPStan, PHPMD, PHPCS, Clippy, detekt, and SwiftLint through one grouped runner step that still emits separate SARIF files and manifest rows per tool.
• Extracts Oxlint's inline workflow body into run_oxlint.sh to keep .github/workflows/scan.yml under the 1,000-line compliance limit.
• Adds focused converters/tests for Buf and the high-impact JSON/compiler-message formats.

Safety notes

• Grouped high-impact tools are internally gated by their individual workflow booleans, and a single tool failure cannot stop later tools.
• Runner-owned configs are used for Buf, SQLFluff, PHPStan, PHPCS, detekt, SwiftLint, and RuboCop where caller config/plugin execution would be risky.
• Prisma Lint is config-gated and skips JS/bare configs to avoid executing caller config code.
• Buf, detekt, SwiftLint, Oxlint, ast-grep, and Prisma Lint use pinned integrity checks where the package format supports the existing runner pattern.
• scan.yml is 996 lines after this batch.

Verified

• python3 .github/scripts/sigilix_sarif_test.py
• python3 .github/scripts/eslint_ts_workflow_test.py
• python3 .github/scripts/tsc_workflow_test.py
• python3 .github/scripts/pylint_workflow_test.py
• python3 .github/scripts/trufflehog_converter_test.py
• python3 .github/scripts/language_config_tools_workflow_test.py
• python3 .github/scripts/knip_workflow_test.py
• python3 .github/scripts/biome_workflow_test.py
• python3 .github/scripts/docs_config_tools_test.py
• python3 .github/scripts/oxlint_workflow_test.py
• python3 .github/scripts/buf_workflow_test.py
• python3 .github/scripts/high_impact_language_tools_test.py
• python3 .github/scripts/ast_grep_workflow_test.py
• python3 .github/scripts/policy_iac_tools_workflow_test.py
• python3 .github/scripts/security_sast_tools_workflow_test.py
• python3 -m py_compile .github/scripts/*.py
• Empty-source runtime check for the grouped high-impact script with all nine tools enabled.
• ruby -e 'require "yaml"; Dir[".github/workflows/*.{yml,yaml}"].each { |f| YAML.load_file(f); puts "yaml ok: #{f}" }'
• git diff --cached --check
• Reviewer model pass: security auditor SHIP; code-reviewer release blockers patched before this PR.

[sigilix]

Sigilix is reviewing this pull request...

You'll see a structured overview here in 30-90 seconds.

+------------------------------------------------------------+
|                                 N                          |
|                           W --+-- E                        |
|                                 S                          |
|          Review the behavior, not just the shape.          |
|                direction: changed behavior                 |
+------------------------------------------------------------+

[coderabbitai]

Warning

Review limit reached

@damartinezjulio, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 51 minutes and 37 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 500abb66-9072-4a60-996f-82559d6d8e0a

📥 Commits

Reviewing files that changed from the base of the PR and between 5b9c52b and 159a4bd.

📒 Files selected for processing (14)

• .github/config/tool-manifest.json
• .github/scripts/buf_to_sarif.py
• .github/scripts/buf_workflow_test.py
• .github/scripts/high_impact_language_tools_test.py
• .github/scripts/high_impact_to_sarif.py
• .github/scripts/oxlint_workflow_test.py
• .github/scripts/run_buf.sh
• .github/scripts/run_high_impact_language_tools.sh
• .github/scripts/run_oxlint.sh
• .github/scripts/sigilix_sarif_contract.py
• .github/scripts/sigilix_sarif_test.py
• .github/workflows/ci.yml
• .github/workflows/scan.yml
• README.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sig-107-buf-runner

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[damartinezjulio]

Post-merge bot/check follow-up:

• Sigilix approved the PR and the final Sigilix check completed successfully.
• CI test/lint and CodeQL completed successfully.
• CodeRabbit posted a review-rate-limit/usage-credit notice instead of review findings, so there was no actionable CodeRabbit feedback to patch on this PR.

Local validation before merge covered the full runner helper suite, py_compile, workflow YAML parse, git diff --check, bash syntax, the empty-source runtime check with the high-impact tools enabled, and the 1k-line file cap.