fix(report): show fix-available hints in vg scan and vg report text

[vibgrate-team]

Summary

vg scan and vg report text output now follow a finding with fix available: … when the scan payload already names a fixed version (fixedVersions or fixedVersion) or a remediation string. The hint is taken only from fields already on the finding — no network lookup.

When that metadata is missing or empty, the line is omitted. Vulnerability finding messages no longer append "no fix available", and stored messages that still end with that phrase drop it in human text. vg why uses the same rule for advisory lines.

JSON and SARIF are unchanged: fix versions stay on finding details (and therefore SARIF properties).

Related issues

Fixes #209

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical
  graph.json / report output (content-hashed IDs, stable sorts; no time,
  randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

• Verify with test/fixtures/fix-available-scan.json: the same artifact renders the same findings block from both the scan text formatter and vg report. Versions are listed in payload order, blanks and duplicates dropped.
• A finding with an empty fixedVersions array prints no fix line.
• pnpm test (4903), pnpm lint (exit 0), and pnpm typecheck passed. Lint still reports five pre-existing unused-variable warnings in unrelated files.