This makes me wonder, what about implementing lints as declarative 'query' API instead of literal AST iteration. For example, there might be an interface to register with the compiler: 'Call this method with a slice of all source locations where a variable of type X is declared' (using emphasis for parts that might be controlled by the crate registering the lint). At least superficially this seems to combine the best aspects of an output file while integrating more closely with the compiler and avoid serialization/deserialization overhead.
Without having given too much thought with regards to the specifics, this might provide pretty good decent compatibility as well. Additional syntactical elements (or combinations thereof) can be added as new result types, or integrated with declarative conditions if necessary.