feat: --progress flag for structured machine-readable progress output

[ajianaz]

Summary

Add --progress flag to output structured JSON progress events to stderr during review execution. This enables GUI consumers (Termul, VS Code extensions, any terminal emulator) to display real-time progress without parsing stdout (which remains clean SARIF).

Motivation

Any tool that embeds cora-cli needs to show progress to users. Currently the only progress signals are unstructured CLI prints. A structured progress output allows consumer apps to:

• Show phase indicators ("Parsing diff...", "Calling LLM...", "Complete")
• Display file count and token usage in real-time
• Support cancellation (detect running state)
• Avoid brittle stdout parsing — stderr is for progress, stdout is for results

Proposed Output (stderr)

{"status":"started","mode":"review","base":"origin/develop","timestamp":"..."}
{"status":"parsing_diff","files_changed":12,"lines_changed":340}
{"status":"calling_llm","provider":"openai","model":"gpt-4o-mini"}
{"status":"llm_response","tokens":{"input":8200,"output":2400},"duration_ms":3200}
{"status":"complete","issues":3,"blocked":false,"tokens":{"input":8200,"output":2400,"estimated_cost_usd":0.003}}
{"status":"error","message":"API timeout after 120s","phase":"calling_llm"}

Specification

• Flag: --progress (optional, opt-in)
• Output stream: stderr only (stdout remains clean for SARIF/pretty/json)
• Format: one JSON object per line (NDJSON)
• Fields per status: extensible, consumers should ignore unknown fields
• Exit code: unchanged — 0 = pass, 1 = error, 2 = blocked

Adoption

This is a prerequisite for Termul integration (cora binary embedded in desktop app) and any future GUI consumer. Zero breaking change — existing CLI users unaffected.

Scope

• cora review --progress only (scan can follow later)
• Progress events at phase transitions, not per-file granularity (keep it simple)

[ajianaz]

Fixed in v0.2.0