Add property coverage for SARIF wire names and conversion boundaries #400

Summary

Add property or equivalent bounded-proof coverage for SARIF wire-name invariants and range-boundary conversions introduced in pull request #363.

Rationale

The SARIF models must always serialize Rust fields artefact_location and artefacts as artifactLocation and artifacts. The pull request also adds saturating usize to i64 and u32 conversions and rejects unrepresentable span offsets. Fixed examples do not cover the required input ranges.

Affected areas

• crates/whitaker_sarif/src/model/location.rs
• crates/whitaker_sarif/src/model/run.rs
• crates/bumpy_road_function/src/driver/diagnostic.rs
• crates/bumpy_road_function/src/driver/segment_builder.rs
• crates/conditional_max_n_branches/src/driver.rs

Required changes

• Generate SARIF locations and runs with varied URIs, optional fields, and non-empty artefact collections.
• Assert that serialized JSON always uses artifactLocation and artifacts, never artefactLocation or artefacts.
• Assert that canonical wire JSON deserializes and round-trips.
• Add boundary-focused cases at, below, and above i64::MAX and u32::MAX.
• Assert saturation or None exactly where the implementation specifies it.
• Add proptest as a whitaker_sarif development dependency, or use an equivalent exhaustive bounded proof.

Acceptance criteria

• Tests cover varied SARIF values and populated collections.
• Tests cover all conversion boundaries named above.
• Tests fail for a wrong SARIF wire name or incorrect boundary result.

Backlinks

• Pull request: Correct en-GB-oxendict spellings in code symbols and prose #363
• Requesting comment: Correct en-GB-oxendict spellings in code symbols and prose #363 (comment)
• Requested by: @leynos