[SizzleUnrlsd]

Summary

• Baselines are written in schema 3: an entry records a digest of the text of every line a finding's span covers, so a changed body of a secret written over several lines is a new finding (baseline: a secret in a multi-line Python string is recognised by its first line only #223).
• Entries hold digests only (line text, value, and JSON pointer, whose keys may be secrets), never the text: the committed baseline holds no accepted secret in plain text (baseline: accepted secrets at a line are recorded in plain text #224).
• .env, YAML, INI and properties values that continue past their key's line (open quote, trailing backslash, deeper indentation) now have a span covering those lines.
• Schema 1 and 2 files are still read and never rewritten. Their entries match single-line findings exactly as before; a finding over several lines is new. Reading one prints a notice on stderr, once per run, that the baseline may contain secrets in plain text and should be reviewed and migrated explicitly to schema 3. The exit status depends on the findings only.
• Digests remove plain-text storage but do not make the file confidential (weak secrets can be guessed); documented, follow-up in baseline: keyed digests (HMAC) with a key kept outside the repository #225.

Verification

• New tests: tests/test_baseline_digests.py, tests/test_config_value_spans.py (red before the fix).
• Existing tests changed with prior approval: tests/test_baseline.py:59, :65, :78, tests/test_file_locations.py:138, :143, tests/test_baseline_schema_1.py:100 (schema 3, digests, notice always shown).
• Full suite green apart from the local test_packaging environment issue; ruff and mypy clean; regression snapshots unchanged; mitmproxy scan: 75 findings, identical to main.

Closes #223
Closes #224