feat(ci): add CI/CD integration — --fail-on, --compact, pipeline templates

Add threshold-based exit codes (--fail-on <severity>) and compact
output mode (--compact) to scan-orchestrator and CLI. Pipeline
templates for GitHub Actions, Azure DevOps, GitLab CI with SARIF
upload. CI/CD guide with Schrems II/NSM compliance documentation.
npm publish preparation (files whitelist, .npmignore). Policy ci
section for distributable CI defaults. Version 6.1.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/llm-security/tests/lib/policy-loader.test.mjs

@@ -100,4 +100,28 @@ describe('policy-loader', () => {
     assert.equal(defaults.trifecta.long_horizon_window, 100);
     assert.equal(defaults.mcp.volume_threshold_bytes, 100_000);
   });
+
+  it('default policy includes ci section with null/false defaults', () => {
+    const defaults = getDefaultPolicy();
+    assert.equal(defaults.ci.failOn, null);
+    assert.equal(defaults.ci.compact, false);
+  });
+
+  it('ci section merges correctly from policy file', () => {
+    writeFileSync(POLICY_FILE, JSON.stringify({
+      ci: { failOn: 'high' },
+    }));
+    const policy = loadPolicy(TEST_ROOT);
+    assert.equal(policy.ci.failOn, 'high');
+    assert.equal(policy.ci.compact, false); // default preserved
+  });
+
+  it('ci section allows compact override', () => {
+    writeFileSync(POLICY_FILE, JSON.stringify({
+      ci: { failOn: 'critical', compact: true },
+    }));
+    const policy = loadPolicy(TEST_ROOT);
+    assert.equal(policy.ci.failOn, 'critical');
+    assert.equal(policy.ci.compact, true);
+  });
 });