fix(vet,debuglog): address review follow-ups on debug-capabilities

[srnnkls]

Follow-up fixes from the branch-diff review of the fas vet + FAS_LOG payload-logging work (originally PR #18, since merged). Each fix has a regression test that fails under the prior behavior.

High

• gc arbitrary-delete footgun — gc now removes only files matching the generated log-file name pattern (^\d{8}T\d{6}Z-[0-9a-f]{8}\.json$). Pointing FAS_LOG at a directory holding unrelated *.json (e.g. package.json) no longer deletes them. (shortID's rand-failure fallback widened 0000→00000000 so gc still matches what Close writes.)
• Duplicate diagnostic — collectDiagErrors recurses into errors.Join children and returns before the tree-descending errors.As, so fas vet --format json|sarif no longer emits the first diagnostic twice.

Medium

• Record the preprocessed input envelope in the debug log — the advertised input field was never populated (evaluate now returns it; run records it).
• vet rejects stray positional arguments instead of silently validating the default dirs.
• vet routes capability errors through the format-aware renderer and emits SARIF on success under --format sarif (was plain ok: text).
• vet success summary writes to stdout instead of the errorf stderr-diagnostic helper; dropped the inert --color flag from vet.
• Extracted registerCommonFlags shared by eval/explain/vet (was duplicated 3×).
• Unexported test-only GC/LogFiles, dropped the Dir() accessor.
• Documented FAS_LOG payload sensitivity (unredacted, 0600, may contain secrets) in the usage text.

Tests

TestGC_PreservesForeignJSON, TestCollectDiagErrors_JoinNoDuplicate, TestRun_Vet_PositionalArg_ExitTwo, TestRun_Vet_FormatSARIF_EmitsSARIF, plus an input-field assertion in TestRun_FasLog_WritesLogFile.

Full suite + gofmt/go vet/golangci-lint green via the pre-commit hooks.