fix: keep security affinity ASCII and report incomplete analysis

[ZeroPoint95]

• Fixed carried-program affinity keys to use stable ASCII on model calls while preserving Unicode session labels and existing ASCII keys.
• Recorded failed hunt attempts separately from completed searches with no findings, including checkpoint and resumed runs.
• Marked incomplete analysis in endings and Markdown, JSON and SARIF reports; retained findings and their existing proof requirements when other hunts failed or a later phase stopped.
• Preserved model routing, tools, read-only access, ceilings, retry policy and proof thresholds.

Validation:

• Reproduced Unicode wire affinity and falsely passing all-failed, partially failed, ceiling and refused-key audits before the repair.
• Focused regressions cover real model-API failure injection, later proof-stage refusals, cancellation, duplicate hunt attempts, checkpoints, resumed and streaming hunts, malformed accounting and Unicode display labels.
• On source commit b9ec226, make build and BASE=3cc50a0fdff621c8918529c82807398089e23175 make pr-ready passed; every selected package passed its first gate run. Related security and review-agent suites passed, with the final presentation correction verified freshly.
• Independent review passed the final committed source.
• The unchanged nonempty quick security fixture passed once in 72.947 seconds: all six hunters completed actual file reads and all three reports were written. The original fixture, model route, ceilings, session/turn bounds and read-only access stayed unchanged; private credentials were removed afterward. This fixture checks model access and report completion, not comprehensive security coverage.

No merge or release action is part of this change.