fix(report): emit SARIF by default for exploit runs (#431)

* fix(report): emit SARIF by default for exploit runs, opt out with report.sarif: false

* docs: describe SARIF as on-by-default for exploit runs

apps/worker/src/services/agent-git-paths.ts

@@ -29,7 +29,7 @@ export function getAgentGitPaths(agentName: AgentName): string[] {
     paths.push(queueFilename);
   }
   // The report agent also emits the structured findings the markdown is rendered from, and the
-  // SARIF log when enabled. Listing the log unconditionally is harmless when it was not written,
+  // SARIF log when produced. Listing the log unconditionally is harmless when it was not written,
   // and keeps a stale one from surviving the rollback of a failed attempt.
   if (agentName === 'report') {
     paths.push(REPORT_JSON_FILENAME);

apps/worker/src/services/reporting.ts

@@ -181,7 +181,7 @@ export async function injectModelIntoReport(
  *
  * The SARIF log is surfaced beside it when present, since a CI step consuming it needs a stable
  * path and cannot be expected to reach into the internals directory. It is absent whenever the
- * run was analysis-only or `report.sarif` was not enabled.
+ * run was analysis-only or `report.sarif` was set to false.
  */
 export async function copyReportToRunRoot(
   repoPath: string,