UI source audit command

Runs the read-only scanner and returns a text or JSON report of UI review leads.

This is the scanner's command-line entrypoint. Run it from the plugin root with Node.js and a project root; findings need source or runtime confirmation, and a successful report may still contain warnings.