Severity escalation: a warning that fires once is noise, the same warning
firing many times in one file is a quality problem. When a rule produces at
least threshold findings in a single file, its warnings in that file
become errors.
External rule sources: git repositories cloned into a local cache, plus
extra local directories. Each configured [[rules.sources]] is resolved to
a directory of rule YAML and the provenance stamped on the rules loaded
from it.