refactor(llm-security): v8 Phase 5 step 4 - swap OWASP_MAP to commons

Second consumer swap of step 4. OWASP_MAP stops being a hardcoded constant in
severity.mjs and is built from the vendored commons artifact
mapping/owasp-map.json by a new scanners/lib/owasp-map.mjs, re-exported from
severity.mjs so the published surface (which the golden gate walks as
severity:OWASP_MAP) is unchanged.

Scope is one of the four maps commons publishes, and the omission is measured,
not incidental. OWASP_MAP has a production consumer: owaspCategorize() reads it
as the per-scanner fallback, and that reaches real report output through
output.mjs's owasp_breakdown. OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP and
OWASP_MCP_MAP have none - every reference tree-wide is a test or a golden
artifact - so they stay source literals, the same call already made for
cyrillic_confusables in the first swap. Porting them would move data no runtime
reads into the load path.

Measured byte-likeness before the swap, all four taxonomies: same 16 prefixes,
same insertion order, same code arrays. Loadable verbatim, unlike the injection
table.

Content preservation proven the same way as the codepoint swap: the golden dump
differs in exactly one record, the sha256 of severity.mjs, which changes by
construction when a table leaves the file. All 83 regex records and all 7 table
records including severity:OWASP_MAP are byte-identical; reference-run.json
unchanged at 61/61. patterns.json re-blessed for the file digest only.

New property, not just preservation: the golden gate now pins the vendored
commons data transitively for this table too. Mutation-proven in both
directions - changing one code value and deleting a whole prefix each turn
three independent gates red (golden table digest, the new owasp-map gate by
name, and the pre-existing severity behaviour tests).

Entries are validated rather than trusted: commons is vendored data, and a
value that is not an array of strings would be spread straight into
owaspCategorize's category list, so a malformed entry is dropped. Graceful-empty
on an unresolvable commons, matching commons-loader's contract - severity.mjs is
on the import path of output.mjs and every orchestrated scanner, so a load throw
would abort a scan rather than degrade it.

Suite 2164 -> 2173, all green.

scanners/lib/severity.mjs

@@ -1,5 +1,8 @@
 // severity.mjs — Constants, risk score calculation, verdict logic
-// Zero dependencies. Used by all scanners and the orchestrator.
+// Used by all scanners and the orchestrator. No external dependencies; the one
+// internal import is the commons-backed OWASP_MAP (v8 Phase 5 step 4).
+
+import { OWASP_MAP } from './owasp-map.mjs';
 
 export const SEVERITY = Object.freeze({
   CRITICAL: 'critical',
@@ -107,25 +110,13 @@ export function gradeFromPassRate(passRate, failsInCritCats = 0, critCount = 0)
 
 /**
  * Scanner prefix to OWASP LLM Top 10 category mapping.
+ *
+ * v8 Phase 5 step 4: built from vendored commons (`mapping/owasp-map.json`)
+ * rather than declared here, and re-exported so this module's published
+ * surface is unchanged. The three maps below are NOT swapped — they have no
+ * production consumer, only tests and golden artifacts; see owasp-map.mjs.
  */
-export const OWASP_MAP = Object.freeze({
-  UNI: ['LLM01'],
-  ENT: ['LLM01', 'LLM03'],
-  PRM: ['LLM06'],
-  DEP: ['LLM03'],
-  TNT: ['LLM01', 'LLM02'],
-  GIT: ['LLM03'],
-  NET: ['LLM02', 'LLM03'],
-  TFA: ['LLM01', 'LLM02', 'LLM06'],
-  MCI: ['LLM01', 'LLM02'],
-  MEM: ['LLM01'],
-  SCR: ['LLM03'],
-  PST: ['LLM01', 'LLM06'],
-  WFL: ['LLM02', 'LLM06'],
-  TRG: ['LLM06'],
-  SIG: ['LLM03', 'LLM02'],
-  AST: ['LLM01', 'LLM02'],
-});
+export { OWASP_MAP };
 
 /**
  * Scanner prefix to OWASP Agentic AI Top 10 (ASI) category mapping.