feat: report incomplete scan data with diagnostics

[luojiyin1987]

Background

When a scan encounters partial failures — transient OSV detail lookup errors, missing offline advisory records, packument fetch failures, remediation computation failures, or chain resolution failures — the current CLI output, HTML report, and JSON output give no indication that the scan result may be incomplete.

Solution

Track five incompleteness scenarios inside scanPackages, build a ScanCompleteness structure, and surface diagnostics to the output layer:

1. CLI output — printFinalStatus and printCompactOutput print a yellow warning banner at the end
2. HTML report — render a completeness-banner below the CVE summary cards, listing each failure reason
3. JSON output — add status, complete, and diagnostics fields at the top level

New types

type ScanDiagnosticCode =
  | "OSV_DETAIL_TRANSIENT_FAILURE"
  | "OSV_DETAIL_OFFLINE_MISSING"
  | "PACKUMENT_FETCH_FAILURE"
  | "REMEDIATION_FAILURE"
  | "CHAIN_RESOLUTION_FAILURE";

type ScanCompleteness = {
  complete: boolean;
  diagnostics: ScanDiagnostic[];
};

[sonukapoor]

Thanks @luojiyin1987 - tracking this via your PR #893. As noted there, we would like to land it as a few focused PRs given the size, but the design is sound. Labeling as enhancement.