fix: redact home-directory paths from machine-readable outputs

[vibgrate-team]

Summary

Default JSON, SARIF and report output could contain absolute home-directory paths (/Users/<user>/…, /home/<user>/…). Those paths leak usernames and make the same project produce different output on different machines.

Machine-readable output now rewrites them with a shared helper, src/core-open/utils/portable-path.ts:

• A path inside the scan or build root becomes relative to that root (src/main.ts).
• A path under the same home directory but outside the root becomes a relative path such as ../other/lib.ts.
• Any other path only loses its /Users/<user>/ or /home/<user>/ prefix.
• URLs and paths that merely contain the letters home are left unchanged.

The rewrite runs when scan results, vg report, and graph JSON, report and HTML are written. Terminal text is unchanged and there's no new flag.

test/portable-output-paths.test.ts plants /home/… and /Users/… fixture paths, checks they don't appear in JSON, SARIF or report output, and checks that identical inputs stay byte-identical.

Related issues

Closes #282

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Determinism preserved
• No proprietary or internal references
• Commits use Conventional Commits and are signed off

How to verify

pnpm test
pnpm lint
pnpm typecheck