Rule metadata: `id`, `severity`, `profiles`, `when:`, and consumer waivers

[Max-Levitskiy]

Priority: P1 · Epic: #71 · Refs: R3, R6, R7, R23, R31, R34, FR-012, FR-013, C18

What

RuleMeta flattened onto every rule entry:

id: workflow-actions-pinned        # required in modules; module-scoped
severity: error                    # error | warn | info (default error)
profiles: [infra-k8s, api]         # empty = all
when: "{{ features.ci }}"          # Tera expression → bool
description: "..."
remediation: "..."                 # overrides the plugin's finding remediation
since: "1.3.0"                     # optional, informational

Consumer side (weaver.yaml):

apps:
  - name: repo
    module: dev-standards
    profiles: [infra-k8s]          # explicit selection (no inference)
    waivers:
      - rule: dev-standards/workflow-actions-pinned
        reason: "renovate migrates these by 2026-12"
        expires: 2026-12-31

• when: evaluated by rendering {{ … }} with the app Tera context plus profiles
  (list) and profile helpers; anything but true ⇒ skip. Render errors ⇒ error.
• Profile mismatch ⇒ skip. A waiver ⇒ status waived (reason and expiry in the
  report); an expired waiver is ignored with a warn line. reason is required.
• enabled: false on a consumer override of a module rule is sugar for a waiver with
  reason: "disabled".
• wvr apply/plan honour when:, profiles, and waivers identically (a waived rule is
  neither checked nor fixed).

Acceptance

• Example 45-rule-profiles-when-waivers: three rules, two profiles, one waiver;
  report shows pass/skip/waived correctly and the summary counts exclude
  skip/waived from the score.
• Test: skip never inflates the score; waived is never printed as pass.
• Test: expired waiver ⇒ rule evaluated, warning printed.

Depends on

#75.