[prx-my]

What changed and why

SARIF output shipped, but two docs pages still described it as unreleased:

• website/docs/getting-started.md showed #cve-lite . --sarif (Coming soon)
• website/docs/how-it-works.md said "SARIF output is planned" and linked to a now-404 issue in the old repository

This updates Getting Started to show --sarif as a supported command and rewrites the "Standards-based output" section to cover JSON, SARIF 2.1.0, and SBOM with links to the existing guides.

Closes #1374

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonukapoor]

Approved.

Both pages were telling people a feature they can use today is still planned, and the issue the old sentence linked for progress has been closed for a long time, so the one thing a curious reader could click told them nothing. The replacement names the three flags and points at the format guides, which is what someone reading that section actually wants.

Worth knowing that this also clears the last pre-transfer repository link in the docs. Your #1370 fixes eleven of the twelve and the twelfth lives inside the sentence this PR deletes, so the two together leave none. I applied them on top of each other to check and they merge clean, but whichever of the two lands second will want a rebase since you touch the same file in both.