pub fn error_envelope(error: &AppError)
Emit the one structured error envelope to stderr.
Violations carry no envelope: their findings are already on stdout and the exit code is the report.