Analyzer settings schema: pass per-analyzer config through scans and record effective settings

[serge-ivo]

Summary

Add per-analyzer settings schemas and pass validated settings into analyzer execution. Core should render/persist settings later, but the CLI must own validation and record effective scan settings for reproducibility.

Why

Settings are currently scattered: .vcqa.json can enable/disable checks and ignore paths, while view-specific thresholds live elsewhere. Framework analyzers need configurable behavior without hardcoding settings into pages or runners.

Tasks

• Define an internal AnalyzerSettingsSchema shape, likely JSON-schema-compatible enough for the app to render later.
• Extend VcqaConfig.checks[checkName] to accept a settings object while preserving enabled and ignore.
• Validate analyzer settings before run; fallback to defaults with a warning/detail rather than crashing scans.
• Pass effective analyzer settings through AnalyzerContext.
• Record effective settings in report metadata or check details, with secrets redacted.
• Add tests for defaults, overrides, invalid values, and disabled checks.

Acceptance criteria

• An analyzer can declare a typed/defaulted setting without custom config parsing.
• .vcqa.json and package.json#vcqa can override analyzer settings.
• Reports contain enough effective-setting data to explain why a result was produced.
• No app UI changes are required in this issue.

Related

• Umbrella: Tracking: analyzer-platform groundwork (schema, stack-gating, fixtures, engine decision) #24
• App follow-up: analyzer-driven Settings UI