fix: unify SEVERITY_ORDER across commands

[jonchurch]

What changed

Create a single source of truth for severity ordering, align it to Severity type order of:

CRITICAL | HIGH | MEDIUM | HIGH_BUG | BUG | LOW

Why

closes #48

There are 5 copies of SEVERITY_ORDER that had drifted. 2 swap MEDIUM and HIGH_BUG, and one is missing LOW so LOW findings sneak past sandbox --min-severity no matter what threshold you pass.

Verification

• pnpm test passes (besides the broken test on macos on main, yah)
• pnpm lint passes
• pnpm knip passes
• If this adds a matcher: ran it against at least one real repo and confirmed the candidate count is sane

Notes for reviewer

Slight refactor for clarity in the revalidate switch statement, compacting an if statement via an intermediate variable, not needed but did it while I was there.

[vercel]

@jonchurch is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.