Vouch request: fix OCSF severity_tag rendering Unknown/Other as [INFO]

[aniruddhaadak80]

What I want to change

I want to open a PR fixing a formatting bug in the OCSF shorthand log formatter: severity_tag in crates/openshell-ocsf/src/format/shorthand.rs renders Unknown (0) and Other (99) severities as [INFO], the same tag as Informational (1). Those are distinct OCSF severities, and severity_char / SeverityId::shorthand_char in the same crate already treat them differently, so the three helpers disagree with each other. I filed the details as issue #3886.

Why

Two reasons worth stating plainly rather than skipping to the PR.

The first is that it is a small, self-contained defect I can fully verify on my own machine, which is what I understand this project's vouch system is trying to select for. I reproduced it as a failing unit assertion, fixed it, and confirmed the crate's full suite, clippy with -D warnings, and rustfmt all pass. No mise run ci, because mise is not installed here and the pinned 1.95.0 MSVC toolchain needs link.exe, which I do not have; I used the 1.98.0 GNU toolchain for the same target instead and noted that in the issue.

The second is a caveat I would rather raise now than have a maintainer discover later. This repository is large and I am new to it, so my read of the code is narrower than a maintainer's would be. I have only worked in crates/openshell-ocsf. I have not studied how severity values are produced upstream of the formatter, so I do not know how often Unknown or Other actually reach format_shorthand in practice — my claim is that the mapping is wrong and untested, not that it is currently causing mislabeled events in your logs. If the real-world frequency is zero, then this is a latent correctness fix and I would rather you weigh it as such.

What I am unsure about

severity_tag takes a u8 while severity_char does the same, but SeverityId also has label() and shorthand_char(). My instinct is that the durable fix is to have severity_tag dispatch through the enum so these cannot drift apart again, but that is a wider diff and I do not want to make that call unilaterally in someone else's crate. I would also accept a maintainer-chosen spelling other than [UNKN].

I have the branch pushed at aniruddhaadak80:fix/ocsf-severity-tag-unknown (one source line plus a test) and will open the PR as soon as I am vouched. I understand from the vouch-check workflow comment that reopening after a /vouch also works, but a fresh PR is cleaner.

I have also been reading CONTRIBUTING.md and the agent skills, and I have not applied any of the project labels to #3886 or tried to move its state — triage and disposition are yours, not mine.