cli: `flow validate` speaks no SARIF and `flow test` no JUnit, while `Diagnostic` already carries position, stable code, message and edits

Observed behavior

grep -rn "junit\|sarif" over cmd/, pkg/, tools/ at 40cc365 returns nothing. flow validate -o json emits Diagnostics with line:col, code, message, step, field and machine-applicable edits; flow test -o json emits a TestReport with per-file coverage. Both are the house's own protojson, which CLI.md's machine-surface rule says is the one encoder.

SARIF is a mechanical projection of exactly the fields Diagnostic has, and it is what puts a Flowfile diagnostic inline on a GitHub pull request with no other integration; JUnit is what every CI system renders a test report from. Neither is a second encoder of Flowstate's own shapes — each is a projection into a format owned elsewhere, the way docs/reference/ projects descriptors into markdown.

Decision wanted

Does -o grow sarif (validate, lint) and junit (test) as projections, or is protojson the contract and the projection a consumer's job? The house rule that -o json is protojson and nothing else was written against a second encoding of our own shapes; it does not obviously cover a projection into a standard. Recommended: grow them, generated from the same messages, with a golden per format and a byte bound on the report. Refused alternative: a separate flow report verb, which is a second spelling of -o.

Found by the whole-system review (docs/plans/2026-09-whole-system-review.md, §"CLI as a product"). Adjacent: #1221 (dogfooding in Actions is where SARIF earns its keep), #346 principle 4, #184.

Start with CLI.md's machine-surface rule and inspect cmd/, pkg/, and tools/ for the existing validate and test output paths; the issue notes that no SARIF or JUnit handling is present. Review the referenced Diagnostic and TestReport fields and the adjacent issues and plan. Done means the output-format decision is resolved, with any accepted projections sharing the existing messages and having a golden per format plus a report-size bound.