feat: centralize finding display to fix unknown severity dropping in compact and verbose output

[coder-Yash886]

Closes #385

Problem

unknown severity findings were silently dropped from terminal output despite being counted in the summary.

• Compact mode — slice(0, 3) after critical/high filter dropped unknown findings entirely
• Verbose mode — medium+ threshold excluded unknown from the table
• HTML / JSON / SARIF — showed all findings correctly ✅

Real example: MAL-2025-21003 on fs@0.0.1-security was invisible in terminal but visible in HTML report.

Changes

• src/output/finding-display.ts — new shared selector module with selectFindingsForTable() and selectFindingsForCompact()
• src/index.ts — uses shared selector for verbose table
• src/output/printers.ts — uses shared selector for compact output
• tests/output.test.ts — regression coverage for unknown findings in compact mode

Test Plan

npm test -- tests/output.test.ts tests/cli-integration.test.ts tests/write-outputs.test.ts

[coder-Yash886]

@sonukapoor please review the PR when you have free time

[sonukapoor]

The fix itself is correct - selectFindingsForCompact handles the unknown-severity case properly and mergeUniqueFindings is a clean way to avoid the slice-drops-unknown problem. The tests in output.test.ts cover the right scenario.

Two things to address:

This branch includes the debug flag work from #471. The first commit here is the debug flag implementation, and fix(scanner): use passed debug logger is also tied to it. #471 still has open CHANGES_REQUESTED. I can't merge this without pulling in all of that unresolved work. Please rebase this branch off the current main so it only contains the finding display changes.

Compact mode now only surfaces direct unknown-severity findings. The old code showed all unknown findings regardless of relationship. The new selectFindingsForCompact filters to finding.relationship === "direct". For the malicious-package case (MAL-* advisories) that's usually correct - you installed the package intentionally. But if an unknown-severity finding is transitive, it goes invisible in compact output. Worth a quick comment in the function confirming this is intentional, or loosening the filter if transitive unknowns should also surface.

[coder-Yash886]

@sonukapoor Superseded by new PR from feat/centralize-finding-display-385-clean (this one accidentally included debug commits).