Enhancement: lead vg report HTML with a compact summary before long finding tables

[vibgrate-team]

Context

Large repos produce HTML reports where vulnerability DB / finding tables dominate the first screen. A compact summary (counts by severity, top ecosystems, link anchors into the tables) would make human review faster without changing the machine-readable contracts.

Local-first: HTML is generated from local scan state.

What to do

1. Add a summary block at the top of vg report HTML (severity counts, optional “fix available” rollup if already computed — see Enhancement: surface “fix available” hints in vg scan / report human output #209).
2. Keep table content complete below; summary is navigation, not a replacement.
3. Preserve determinism: same scan input → same HTML structure/order.
4. Add a small golden/fixture assertion if the report HTML path is tested.

Acceptance

• HTML opens with a compact summary
• Full tables remain reachable via anchors or clear sections
• Deterministic output
• DCO sign-off

Refs: #209 · #160 (absent scores ≠ 0)

[vibgrate-team]

Spec notes for implementers

Current. vg report (src/reporting/commands/report.ts) formats text|json|md only — no HTML. The sole HTML emitter today is the code-graph overview src/engine/html.ts (renderHtml → hubs/areas tables). Vuln/finding tables for humans are text/json/SARIF from vg scan.

Target. Add an HTML path for scan findings (prefer extending vg report --format html reading .vibgrate/scan_result.json, or document if you attach a findings section to graph HTML — pick one surface and stick to it).

Summary block (above fold):

• Counts by severity for vuln/security findings (absent score ≠ 0 — see Reporting: ensure absent scores render as absent (null), never as 0 #160).
• Optional “fix available” rollup from finding details.fixedVersions when present (vulnerability-scanner.ts).
• Anchor links into full tables/sections below (summary is navigation, not a replacement).

Determinism: same artifact → same HTML structure/order (stable sort keys; no wall-clock). Small golden/string assert if the HTML path is tested.