pvs skill: mirror CI --security-related-issues flag and ignore SARIF output

- Add --security-related-issues to run_pvs.sh and AGENTS.md analyze commands
  so local runs reproduce the CI SAST classification (static_analysis.yml).
- Ignore *.sarif so a successful run leaves the worktree clean.

Addresses Codex review on #3695.

3 files changed, 4 insertions, 0 deletions

diff --git a/.claude/skills/pvs/run_pvs.sh b/.claude/skills/pvs/run_pvs.sh
index 3a829327d..d8604b697 100755
--- a/.claude/skills/pvs/run_pvs.sh
+++ b/.claude/skills/pvs/run_pvs.sh
@@ -69,6 +69,7 @@ pvs-studio-analyzer analyze \
   -f "${COMPILE_DB}" \
   -R .PVS-Studio/.pvsconfig \
   -o "${REPORT_LOG}" -j"${JOBS}" \
+  --security-related-issues \
   --misra-c-version 2023 --misra-cpp-version 2008 --use-old-parser \
   "$@"
 
diff --git a/.gitignore b/.gitignore
index c11e51bb9..f3bd8c926 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,7 @@ latex
 *.env
 *.ind
 *.log
+*.sarif
 *.map
 *.obj
 *.jlink
diff --git a/AGENTS.md b/AGENTS.md
index 8ea650ecb..c26887425 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -163,6 +163,7 @@ pvs-studio-analyzer analyze \
   -f examples/cmake-build-raspberry_pi_pico/compile_commands.json \
   -R .PVS-Studio/.pvsconfig \
   -o pvs-report.log -j12 \
+  --security-related-issues \
   --misra-c-version 2023 --misra-cpp-version 2008 --use-old-parser
 
 # Specific files: -S takes a plaintext list (one path per line), not paths directly:
@@ -172,6 +173,7 @@ pvs-studio-analyzer analyze \
   -R .PVS-Studio/.pvsconfig \
   -S files.txt \
   -o pvs-report.log -j12 \
+  --security-related-issues \
   --misra-c-version 2023 --misra-cpp-version 2008 --use-old-parser
 
 plog-converter -a GA:1,2 -t errorfile pvs-report.log     # view results