Surface optional analyzer results and policies in reusable workflow summaries #73

Outcome

Surface explicitly enabled optional analyses in the public/internal reusable workflows, beginning with the native Magic Numbers command delivered by #66. Existing callers keep the current style-only behavior by default. This is distinct from #8's analyzer command and only partially related to #10's broader structured ECS/Rector result contracts.

Acceptance

• Optional analyzers run only when explicitly enabled. Distinguish disabled, not executed (for example empty eligible selection), clean, findings and operational error; do not infer a clean run from skipped work.
• Give verified findings an explicit report-only or blocking policy. Operational failures, invalid/malformed output, unavailable tooling, timeout and inconsistent status/report combinations remain failures. No blanket continue-on-error or false clean result.
• Always produce a visible GitHub job summary, including when analysis finds issues or fails; show tool/status, truthful counts, files and available line information. Preserve native meaning (for example Rector changed-file count is not a PHPMND finding count).
• Bound execution, captured report/diagnostic sizes and summary entries. Escape untrusted source, paths and messages; never interpret native output as GitHub workflow commands or Markdown/HTML instructions.
• Reuse the current exact base/head, merge-base selection, dynamic consumer Git-ignore policy and containment rules where the analyzer supports changed-file selection. Keep Rector's explicitly selected native configuration/path/target contract; no automatic semantic apply.
• Preserve existing inputs/events/runtime provenance, hosted runners, read-only permissions, separate tool/consumer checkouts, no persisted credentials and plugins/scripts disabled during tool installation. No consumer dependency installation, configuration mutation, privileged target event or required-check changes.
• Apply the same result/policy boundary to other actually supported optional tools. Qualify native structured output and exit semantics first; contributor-only Twig evaluation and type-analysis candidates are not existing consumer CLI capabilities.
• Cover real native clean/findings/error/empty-selection cases, policy choices, disabled/no execution, output limits, timeouts, malicious path/content escaping and fork-safe wiring. Update README, canonical RST docs and consumer resource examples together.

Native evidence and dependencies

PHPMND 3.6.1 uses exit 1 for findings and may also fail with that status; its XML report must be validated before classification. The XML fileCount counts files containing findings, not all scanned files, and empty selection needs a separate truthful execution indicator. XML columns are display hints rather than safe AST patch identities.

Rector 2.4.2 provides native JSON with changed-file/error totals and error locations, and returns 0/2/1 for clean/dry-run differences/failure. The current Code Standards refactor CLI does not expose that output representation, so a minimal qualified adapter is needed before applying report-only severity to its findings. Executable Rector configuration remains an explicit unprivileged trust boundary.

Depend on the actual merge of #66 and use an independent main-based PR afterward; do not create an unnecessary stack. No autofix, rollout, release/tag or new security permissions are included.