Version the package-review artifact with $schema + producer (review #5)

The package-review JSON (consumed by the REIR adapter and CI) carried no schema
id or producer version, so a consumer could not reason about compatibility.

Add a `$schema` ("rsscript.package_review.v0.1") and `producer` {name, version
from CARGO_PKG_VERSION} envelope to PackageReview. Additive and ignored by the
REIR adapter (no deny_unknown_fields); bump the schema id on breaking changes.
(REIR bundles and rsspkg.lock were already versioned.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

src/package/review.rs

@@ -265,6 +265,8 @@ pub(super) fn review_package_dir_with_features(
     });
 
     Ok(PackageReview {
+        schema: super::types::PACKAGE_REVIEW_SCHEMA.to_string(),
+        producer: super::types::ArtifactProducer::current(),
         package: super::package_identity(manifest),
         manifest_path: package.manifest_path.display().to_string(),
         risk,

src/package/types.rs

@@ -6,8 +6,31 @@ use crate::diagnostic::{Diagnostic, Span};
 use crate::review::{ReviewFinding, ReviewMap};
 use crate::rust_lower::NativeRustDependency;
 
+/// Schema id for the package-review JSON artifact. Bump on breaking changes.
+pub const PACKAGE_REVIEW_SCHEMA: &str = "rsscript.package_review.v0.1";
+
+/// The tool + version that produced an artifact, so consumers can reason about
+/// schema compatibility instead of guessing.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct ArtifactProducer {
+    pub name: String,
+    pub version: String,
+}
+
+impl ArtifactProducer {
+    pub fn current() -> Self {
+        Self {
+            name: "rsscript".to_string(),
+            version: env!("CARGO_PKG_VERSION").to_string(),
+        }
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct PackageReview {
+    #[serde(rename = "$schema")]
+    pub schema: String,
+    pub producer: ArtifactProducer,
     pub package: PackageIdentity,
     pub manifest_path: String,
     pub risk: PackageRisk,