Attach git blame (last-touched-by, last-commit) to scan repo findings

[JTP75]

Description

For scan repo, findings have no link back to who introduced the code or when. A competitive scan against another AI-artifact scanner (stoa) showed this gap concretely: stoa attaches last_touched_by and last_commit (hash + date) to each detected artifact via git blame, which is useful for routing a finding to the right person during triage. vettd's report has no equivalent attribution field.

Scope

• For scan repo only (where a local git repo is already required/available), enrich each finding or artifact entry with the last commit that touched the relevant file: author and commit hash/date.
• Should degrade gracefully (field omitted or null) when git blame is unavailable (e.g. shallow clone, file not tracked).

Acceptance Criteria

• Findings/artifacts from scan repo include last-touched-by author and last-commit hash/date when derivable
• Field is present in both JSON and terminal output
• Absence of git history (untracked file, shallow clone) does not error the scan, field is simply omitted
• Covered by tests against a fixture repo with known commit history