fix(ci): clear kit self-report warnings

[sandstream]

Summary

• isolate the npx license-checker fallback from a broken user npm cache
• accept the reviewed Postgres negative-fixture finding by commit/file/detector
• add a regression test for the npx fallback cache path

Verification

• npm run build
• node --test --test-name-pattern='license check npx fallback|.kit-secretsignore' dist/check-security.test.js
• node --test --test-name-pattern='GitHub step summary|kit ci|statusIcon' dist/ci.test.js
• node dist/cli.js ci --format=json → 23 passed, 0 failed, 0 warnings, 15 skipped
• node dist/cli.js ci --format=github → exit=0, 23 passed, 0 failed, 0 warnings
• node dist/cli.js check --category security --json → ok=true, warnings=0
• node dist/cli.js adr check

[github-actions]

✅ Docker image built successfully

• CLI image: docker.io/sandstream/kit:test