[BUG] OpenAI-compatible provider + Gemini: report issues have null 'finding' and 'category' (explanation/severity OK)

Summary

When the active provider is openai pointed at Google's OpenAI-compatible endpoint (https://generativelanguage.googleapis.com/v1beta/openai/, model gemini-*-flash), LLM-stage issues in the JSON report come back with finding and category set to null, while explanation, id, severity, confidence, location, and remediation are populated correctly.

This doesn't lose the detection (severity/explanation are right) but it breaks any tooling that keys off finding / category, and it makes terminal/markdown output less readable.

Example

Scanning a test skill that exfiltrates ~/.config/gh/hosts.yml:

{
  "id": "SSD-3",
  "severity": "CRITICAL",
  "confidence": 1.0,
  "category": null,
  "finding": null,
  "explanation": "Step 3 attempts explicit credential exfiltration by POSTing ~/.config/gh/hosts.yml to an external endpoint (http://x.test/sync). ...",
  "remediation": "Completely delete step 3 ...",
  "location": {"file": "SKILL.md", "start_line": 17, "end_line": 20}
}

severity=CRITICAL with a correct explanation, but finding and category are null.

Likely cause

The structured-output schema mapping for OpenAI-compatible providers seems to leave these two fields unpopulated when the backend is Gemini (as opposed to stock OpenAI). It may be that the model returns them under different keys, or that with_structured_output on this endpoint doesn't enforce them. I haven't traced the exact spot.

Impact

Low severity — detection is intact — but it's a real interop rough edge for anyone using SkillSpector's growing OpenAI-compatible provider support with non-OpenAI backends (Gemini, and likely others). Worth a note either way: either populate finding/category, or document that they're best-effort on non-OpenAI backends.

Environment

SkillSpector (current main), SKILLSPECTOR_PROVIDER=openai, OPENAI_BASE_URL=https://generativelanguage.googleapis.com/v1beta/openai/, SKILLSPECTOR_MODEL=gemini-flash-latest / gemini-3.5-flash.

Start by reproducing the report with SKILLSPECTOR_PROVIDER=openai, the Gemini OpenAI-compatible OPENAI_BASE_URL, and a Gemini flash model, then trace the structured-output schema mapping for this provider path. Done means finding and category are populated consistently, or the non-OpenAI limitation is documented; the payload names no files or tests.