Keep severity calibration consistent across scan modes

[soyeon-oai]

Standard and Deep scans can assign different severities to the same vulnerability despite analyzing the same repository revision and substantially equivalent evidence.

Reproduction: run both scan modes against the same synthetic vulnerable repository and compare severity levels for matching findings across repeated runs.

Expected: materially equivalent findings receive consistent severities, or any difference is explained by additional evidence recorded in the finding.

[su-jin1425]

Hi, I’d like to work on this issue. I’ll investigate how severity is calibrated across Standard and Deep scans, identify the source of the inconsistency, and add a fix with regression tests. I’ll share my plan ASAP. Please confirm before I start investigating and implementing a fix.