docs: say where the report goes when a scan is too big for the terminal

[Ndevu12]

A large sweep stops printing per-finding detail and writes the full report to a file instead. The reference said only that a path is printed on stderr — not where the file lands, how long it lasts, or that what it contains differs from what was on screen.

So a reader who scrolled past that line had no way to find the report again, and no reason to expect the copy on disk to be redacted when the terminal's was not.

Now documented

You passed	Written to
-d DIR	DIR/latest.md and DIR/latest.json
nothing	a fresh sab-report-… temporary directory, printed with the report

Plus: the evidence in that file is redacted, as in any artifact on disk; saw never deletes the temporary copy, so it survives at the operating system's discretion rather than being cleaned up; and --json turns the spill off entirely, because that payload already carries every finding in full.

Lives in reference/cli/sinks.md, which is where the other destinations are described, with a pointer from reference/cli/scan.md where the behaviour is first mentioned.

Verification

Every claim was read off the code, not from the previous docs:

• service/run.py:320 — spill = not json_out and (…), so --json suppresses it, while a -d you asked for is still written
• service/run.py:351 — tempfile.mkdtemp(prefix="sab-report-")
• sinks/file_sink.py:25-27 — redact_payload then latest.json + latest.md

That last check caught an error in my first draft, which said --json meant no file at all — untrue when -d is also passed. Corrected before committing.

Link and cross-file-anchor check clean across 51 markdown files.

Closes #1471