Function stamp_security_finding_ids 

pub fn stamp_security_finding_ids(findings: &mut [SecurityFinding], root: &Path)

Set the finding_id of each finding in findings.

The shared analysis pipeline calls this once, directly after detection, so the CLI, MCP and the LSP all read the same id. A path under root is made root-relative before the digest. A path outside root stays as it is, as in the CLI JSON output.