feat(05-01): extend VerifySpec and Finding, add gjson dep

- VerifySpec: add SuccessCodes, FailureCodes, RateLimitCodes, MetadataPaths, Body
- Preserve legacy ValidStatus/InvalidStatus for backward compat
- Add EffectiveSuccessCodes/FailureCodes/RateLimitCodes fallback helpers
- Add ExtractMetadata helper using gjson (skeleton for Plan 05-03)
- Finding: add Verified, VerifyStatus, VerifyHTTPCode, VerifyMetadata, VerifyError
- Add github.com/tidwall/gjson v1.18.0 as direct dependency

pkg/engine/finding.go

@@ -14,6 +14,13 @@ type Finding struct {
 	LineNumber   int
 	Offset       int64
 	DetectedAt   time.Time
+
+	// Verification fields populated when scan --verify is set (Phase 5).
+	Verified       bool              // true if verifier ran against this finding
+	VerifyStatus   string            // "live", "dead", "rate_limited", "error", "unknown"
+	VerifyHTTPCode int               // HTTP status code returned by verify endpoint
+	VerifyMetadata map[string]string // extracted metadata from response (org, tier, etc.)
+	VerifyError    string            // non-empty if VerifyStatus == "error"
 }
 
 // MaskKey returns a masked representation: first 8 chars + "..." + last 4 chars.