Audit report model

Normalizes diagnostics and provides stable ordering and severity counts.

These internal helpers keep report aggregation consistent across the scanner. They do not perform an independent review of the application.