fix(report): reject unknown --format values and document report formats

[vibgrate-team]

Summary

vg report --format only accepts md, text, and json (text is the default). Unknown values such as html used to render the text report and exit 0. They now exit 5 before the artifact is read, write nothing to stdout, and print one stderr line naming the value and the valid ones:

error: unknown --format "html" (expected md, text, json)

DOCS.md now lists what the Markdown and text formatters actually emit, the intentional differences between them, and that json prints the loaded scan artifact unchanged (the only stable machine-readable contract). There is no HTML report.

The agent skill no longer lists sarif as a vg report format. Vendored src/core-open/formatters/ files were left alone — vg report uses src/reporting/formatters/.

Related issues

Closes #268

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated where behavior changed
• Determinism preserved
• No proprietary or internal references
• Commits use Conventional Commits and are signed off

How to verify

pnpm exec vitest run src/reporting/commands/report.test.ts
pnpm test
pnpm lint
pnpm typecheck