fix(security): absorb stronger severity + threat_level on merge dedup

MergeFindings phase-1 dedup by (rule_id, location) took max Confidence
and the most-severe Tier but kept the first occurrence's Severity and
ThreatLevel, discarding a later duplicate's if it was more severe. A
low/info finding followed by a high/warning duplicate at the same
(rule_id, location) merged at the LOWER severity, making the aggregate
CalculateRiskScore and the report summary order-dependent, contradicting
US2's "max severity among agreeing findings" intent.

Add severityRank and threatLevelRank ordering helpers (strict refinements
of threatCategory's bucketing, so they never disagree with
CalculateRiskScore) and take the more-severe Severity and ThreatLevel on
absorb. Merging the same two findings in either order now yields
identical Severity/ThreatLevel/Confidence/Tier and an identical risk
score.

Related: Spec 077

Author: Dumbris

internal/security/scanner/sarif.go

@@ -462,6 +462,45 @@ func tierRank(tier string) int {
 	}
 }
 
+// severityRank orders CVSS severities so the more-severe one wins on merge:
+// critical > high > medium > low > info > empty/unknown. The ordering is a
+// strict refinement of threatCategory's severity fallback (critical→dangerous,
+// high/medium→warning, low→info), so taking the max severity here never
+// disagrees with CalculateRiskScore's bucketing.
+func severityRank(sev string) int {
+	switch sev {
+	case SeverityCritical:
+		return 5
+	case SeverityHigh:
+		return 4
+	case SeverityMedium:
+		return 3
+	case SeverityLow:
+		return 2
+	case SeverityInfo:
+		return 1
+	default:
+		return 0
+	}
+}
+
+// threatLevelRank orders user-facing threat levels so the more-severe one wins
+// on merge: dangerous > warning > info > empty/unknown. This mirrors
+// threatCategory's ThreatLevel bucketing exactly, so taking the max threat
+// level here is consistent with CalculateRiskScore.
+func threatLevelRank(level string) int {
+	switch level {
+	case ThreatLevelDangerous:
+		return 3
+	case ThreatLevelWarning:
+		return 2
+	case ThreatLevelInfo:
+		return 1
+	default:
+		return 0
+	}
+}
+
 // findingSources returns the contributing scanner ids for a finding, preferring
 // the explicit Sources list (Spec 077) and falling back to the single Scanner
 // id for legacy findings that predate multi-source attribution.
@@ -525,16 +564,24 @@ func MergeFindings(findings []ScanFinding) []ScanFinding {
 		if pos, ok := index[k]; ok {
 			result[pos].Sources = sortedUnion(result[pos].Sources, srcs)
 			// Absorb the duplicate's stronger fields (Spec 077): keep the
-			// higher confidence, the more-severe tier (hard > soft), and the
-			// union of signals — otherwise merging a hard/high-confidence
-			// finding with a same-(rule_id,location) soft/low-confidence
-			// duplicate would silently drop the hard tier and confidence.
+			// higher confidence, the more-severe tier (hard > soft), the
+			// more-severe CVSS severity and user-facing threat level, and the
+			// union of signals — otherwise merging a hard/high finding with a
+			// same-(rule_id,location) soft/low duplicate would silently drop
+			// the stronger fields, making CalculateRiskScore and the summary
+			// order-dependent.
 			if f.Confidence > result[pos].Confidence {
 				result[pos].Confidence = f.Confidence
 			}
 			if tierRank(f.Tier) > tierRank(result[pos].Tier) {
 				result[pos].Tier = f.Tier
 			}
+			if severityRank(f.Severity) > severityRank(result[pos].Severity) {
+				result[pos].Severity = f.Severity
+			}
+			if threatLevelRank(f.ThreatLevel) > threatLevelRank(result[pos].ThreatLevel) {
+				result[pos].ThreatLevel = f.ThreatLevel
+			}
 			result[pos].Signals = sortedUnion(result[pos].Signals, f.Signals)
 			continue
 		}

internal/security/scanner/sarif_test.go

@@ -358,6 +358,63 @@ func TestMergeFindingsDedupByRuleAndLocation(t *testing.T) {
 	}
 }
 
+// TestMergeFindingsAbsorbsStrongerSeverity proves Spec 077 (US2): when a
+// low/info duplicate and a high/warning duplicate share the same
+// (rule_id, location), the merged finding takes the MORE-SEVERE Severity and
+// ThreatLevel (alongside max Confidence and most-severe Tier) regardless of the
+// order in which the two are presented. Absorbing only some of the stronger
+// fields would make CalculateRiskScore and the summary order-dependent.
+func TestMergeFindingsAbsorbsStrongerSeverity(t *testing.T) {
+	weak := ScanFinding{
+		RuleID: "detect.tpa", Location: "srv:tool", ThreatType: ThreatToolPoisoning,
+		Severity: SeverityInfo, ThreatLevel: ThreatLevelInfo, Tier: TierSoft,
+		Confidence: 0.3, Scanner: "scanner-a", Sources: []string{"scanner-a"},
+	}
+	strong := ScanFinding{
+		RuleID: "detect.tpa", Location: "srv:tool", ThreatType: ThreatToolPoisoning,
+		Severity: SeverityHigh, ThreatLevel: ThreatLevelWarning, Tier: TierHard,
+		Confidence: 0.9, Scanner: "scanner-b", Sources: []string{"scanner-b"},
+	}
+
+	assertMerged := func(t *testing.T, merged []ScanFinding) {
+		t.Helper()
+		if len(merged) != 1 {
+			t.Fatalf("expected exactly 1 merged finding, got %d: %+v", len(merged), merged)
+		}
+		f := merged[0]
+		if f.Severity != SeverityHigh {
+			t.Errorf("expected merged Severity=high, got %q", f.Severity)
+		}
+		if f.ThreatLevel != ThreatLevelWarning {
+			t.Errorf("expected merged ThreatLevel=warning, got %q", f.ThreatLevel)
+		}
+		if f.Tier != TierHard {
+			t.Errorf("expected merged Tier=hard, got %q", f.Tier)
+		}
+		// Max of the two confidences (0.9), possibly raised further by the
+		// two-source consensus boost — never the weak 0.3.
+		if f.Confidence < 0.9 {
+			t.Errorf("expected merged Confidence>=0.9, got %v", f.Confidence)
+		}
+	}
+
+	weakFirst := MergeFindings([]ScanFinding{weak, strong})
+	strongFirst := MergeFindings([]ScanFinding{strong, weak})
+	assertMerged(t, weakFirst)
+	assertMerged(t, strongFirst)
+
+	// The whole point: the merge — and therefore the aggregate risk score — is
+	// order-independent. A weak-then-strong ordering must not score lower than a
+	// strong-then-weak ordering.
+	if got, want := CalculateRiskScore(weakFirst), CalculateRiskScore(strongFirst); got != want {
+		t.Errorf("CalculateRiskScore is order-dependent: weak-first=%d strong-first=%d", got, want)
+	}
+	// And both must reflect the high/warning severity, not the info floor.
+	if s := CalculateRiskScore(weakFirst); s == 0 {
+		t.Errorf("expected non-zero risk score after absorbing the warning-level duplicate, got %d", s)
+	}
+}
+
 // TestMergeFindingsConsensusBoostsConfidence proves Spec 077 FR-012: when two
 // independent sources agree on the same (location, threat_type) — even via
 // different rule ids — the merged finding's confidence rises above the