feat(report): keep advisory corpus metadata in a collapsed HTML footer

[vibgrate-team]

Summary

vg report --format html reserved #advisory-corpus as an empty hidden mount, so advisory-database provenance never appeared on the page. Putting that metadata in a top banner would push the summary and finding tables down.

The page now fills that mount with a collapsed <details> footer after the vulnerability, security, and other-finding tables. It reads fields already stored on extended.vulnerabilities:

• source — osv (online OSV), manifest (offline package-version manifest), unreachable, or none
• totalAdvisories
• how many packages are listed
• severityCounts, always in the order critical, high, moderate, low, unknown

The scan artifact does not store a separate advisory-corpus version. source is the recorded database provenance. A missing vulnerability block says "Not scanned". source: "unreachable" records the source and does not print zero counts. Strings are redacted and escaped like the rest of the page. The same artifact still produces the same HTML: no clock, no randomness, and severity counts do not follow object key order.

DOCS.md and the README note that this provenance lives in the collapsed #advisory-corpus footer.

Related issues

Closes #245

How to verify

pnpm test
pnpm lint
pnpm typecheck

pnpm test (5240 passed), pnpm lint (no new issues), and pnpm typecheck passed. src/reporting/formatters/html.test.ts asserts footer content, field order, placement after the finding tables, collapsed markup, escaping, and byte-stable output when package order or severity key order changes.

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

The footer stays collapsed (no open attribute) and has no banner styling, so the summary and tables remain first. Package names and advisory ids stay in the tables; the footer only carries the source and the counts.