feat(safegres): drive source, outputs and baselines from the config file

[pyramation]

Summary

Everything a CI job needs already exists as a flag, which is why every repo that uses safegres ends up with a wrapper script holding the flag string (constructive-db/bin/safegres-check.cjs is 181 lines of exactly that). The four things a job repeats every run had no config-file equivalent: where the database comes from, where artifacts go, which baseline to diff, and whether to gate on new debt. They do now, so the job is one word:

// .safegresrc.json — paths are relative to this file
{ "extends": "safegres:constructive",
  "source":  { "pgpm": "application/app" },
  "callGraph": { "enabled": true },
  "perf":    { "enabled": true, "baseline": "ci/perf-baseline.json", "failOnNew": true },
  "outputs": { "dir": "safegres-reports" },
  "failOn":  { "grade": "B" } }

$ safegres audit          # or `safegres lint`, the new alias, in a package.json script

outputs.dir (and --out <dir>) writes safegres.{json,md,sarif}, so nobody has to remember which extension goes with which renderer; a named outputs.json still overrides its own file. Directories are created — CI should not have to mkdir -p.

Path semantics, the one decision here. A path from the config file resolves against that file; a path from a flag stays relative to cwd. Otherwise a job that cds into a package reads a different baseline than the one committed next to the rules, and --write-json out.json stops meaning what every other CLI means by it. Flags win when both are given.

Merging is one pure function, resolveRunPaths(argv, config, configDir) in cli/shared.ts, so the precedence is unit-tested rather than asserted eight times inline in the command.

Two escapes, now that a committed file can gate. The same file is read by more than one job, so both directions need a way out:

• a connection named on the command line beats source.pgpm — safegres audit --database staging audits staging instead of deploying a throwaway copy of the same schema. PGDATABASE does not count: it is set on every runner.
• --report-only evaluates and reports every gate, then exits 0 — how to run a gated config as an advisory job against a second database, where the file's baseline doesn't apply.

Nothing about analysis or scoring moves: the new keys aren't in the fingerprint's scoring surface (it's a whitelist), so an identical database still fingerprints identically. Sealed runs are unaffected — they don't read a config file, so they can't pick up a baseline or a source either.

Also a ## Features list near the top of the README, placed like pgsql-parser's.

Next: this unblocks cutting a release and deleting bin/safegres-check.cjs in constructive-db (planning #1370).

Link to Devin session: https://app.devin.ai/sessions/b7874ecee0c7471ea271e6e7193869dc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring