`wvr check --json` report, typed exit codes, severity-derived gate

[Max-Levitskiy]

Priority: P1 · Epic: #71 · Refs: R22, R23, R24, R32, FR-005

Why

wvr check prints a comfy_table and bails with a count; the global --json only
switches log format. There is no way for CI, a dashboard, or an agent to consume
results, and exit codes are whatever anyhow produces.

What

1. --format table|json on check (and plan); --json global flag implies
   --format json for result output. Schema in the design doc: format_version,
   target, rules[] (id, type, module, resolved_commit, profile, severity, status,
   fixable, findings[] with path/location/message/expected/observed/remediation),
   summary (counts by status and severity, score = pass / (pass + fail) over
   error+warn rules).
2. Exit codes everywhere: 0 conformant/converged, 1 user error (bad config, unknown
   app), 2 violations or changes (check; plan --detailed-exitcode), 3 system
   error (IO, git, network), 4 plugin error (load, checksum, trap). Implemented as a
   WeaverError enum with exit_code(); main maps it.
3. Gate rule: exit 2 only when at least one fail has severity: error; warn/info
   failures never change the exit code. --fail-on warn lowers the threshold.
4. Table output gains columns: severity, status, source (module@sha7), and prints
   remediation under each failing row.
5. --output <file> writes the JSON report.

Acceptance

• Example 46-check-json-report with custom_assertions on the JSON (status per rule,
  summary counts) and expected_exit_code: 2.
• Tests for each exit code path, including "missing tool ⇒ status error ⇒ exit 2"
  (an unevaluable error-severity rule fails the gate; it never passes).
• JSON output is deterministic (rules ordered by module, then declaration order; no
  timestamps unless --timestamps).

Depends on

#75, #76.