feat(surface): make attack surface first-class in the finding pipeline

src/patterns/ejs.rs

@@ -80,6 +80,7 @@ pub fn scan_ejs_file(path: &Path, bytes: &[u8]) -> Vec<Diag> {
                 }),
                 rank_score: None,
                 rank_reason: None,
+                exposure: None,
                 suppressed: false,
                 suppression: None,
                 triage_state: "open".to_string(),