Feature: --fail-on severity exit code and versioned JSON schema

Problem

• The README names CI gating as a goal, but --json has no severity-based exit code and no versioned schema other tools can depend on.
• There is no clean checkpoint before git send-email or b4.

Proposal

• Add --fail-on=critical|high|medium|low so boro exits non-zero when a surviving finding meets the threshold. Default stays today's always-zero behavior.
• Stamp the --json document with a schema_version field.
• Together this makes boro usable as a pre-send check or a CI step, and gives downstream tools a stable contract.

Before / after

Before:                                        After:
  boro review --json ...                         boro review --json --fail-on=high ...
  ->  always exit 0                               ->  exit 1 if a High survives
  ->  schema informal                            ->  {"schema_version":1, ...}

Notes

• Reuses the existing per-severity counts, so no new analysis is needed.
• Opt-in and additive, no change to the review pipeline.
• Pairs naturally with a report-diffing command as a stable consumer.

If approved, I would be willing to implement this feature.

Start with the boro review entry point and trace how --json output, existing per-severity counts, and process exit status are handled. Done means --fail-on remains opt-in, matching surviving findings produce a non-zero exit, and JSON output includes schema_version while default behavior remains unchanged.