feat(report): add risk and next-action guidance

[omobolajiadeyan]

Summary

• reuse the existing terminal summarizeRisk() and summarizeNextAction() logic in HTML reports
• show escaped Risk summary and Next action fields in expanded finding details
• support both single-project and multi-folder HTML reports
• keep normal JSON serialization backward compatible
• document the new HTML report fields

Tests

• npm test -- --runInBand (30 suites passed; 440 passed, 1 skipped)
• npm run build
• npm audit --omit=dev (0 vulnerabilities)

Coverage includes direct, transitive, and malicious-package guidance plus HTML escaping and JSON-contract protection.

Closes #233

AI assistance disclosure

OpenAI Codex assisted with implementation, tests, and documentation. I reviewed the changes and verified the full Jest suite, TypeScript build, and runtime dependency audit. I remain responsible for the contribution.

[sonukapoor]

Please move Risk Summary and Next Action into the third column (Recommended Action), not the first. Description tells the reader what is wrong - Risk Summary and Next Action tell them what to do about it, which belongs alongside the fix command. Column 3 should read: fix command, then Risk Summary, then Next Action.

Same change applies to multi-folder-html-reporter.ts if you added it there too.

[omobolajiadeyan]

Addressed in 4b7dbcb.

Risk Summary and Next Action now render in the third Recommended Action column, immediately after the fix command or explanatory remediation note. The Description column now contains only the vulnerability description. Because the multi-folder report reuses renderFindingRow, the same placement applies there as well.

I also strengthened the HTML reporter test to assert the ordering: Recommended Action, then Risk Summary, then Next Action. Validation: 40 focused tests passed, TypeScript build passed, npm audit reported 0 vulnerabilities, and git diff --check passed.

[omobolajiadeyan]

Rebased onto v1.22.0 after implementing the requested table layout: Risk Summary and Next Action now appear in the Recommended Action column. Post-rebase validation: 123 focused tests pass, TypeScript builds, npm audit reports 0 vulnerabilities, and git diff --check passes. Ready for re-review.