feat: consume and emit multi-category signals (#879)

[JTP75]

What

CLI support for epic #879: consume and emit the scanner's signal/coverage surface end to end.

• Pins vettd-skill-scanner v0.2.0 (crates/vettd-cli/Cargo.toml, git dependency by tag).
• Contract 2.5.0 (COMPILED_CONTRACT_VERSION and checked-in scanner-data-contract.json): emits signals/coverage in the scan payload. The signals/coverage field shapes are byte-identical to the server's contract file (vettd feat/issue-879-signals-ingest).
• directory signals <slug> --json — raw passthrough of the public signals endpoint. --json forwards the fetched payload verbatim: a re-serialized allow-list view would drop neutral nulls and unknown fields.
• Compact signalCategories on list / search / view / compare cards, mirroring the server's CategorySummary shapes (all-optional camelCase; absent or unknown values degrade to a plain display).
• Local scan renders signals and coverage per artifact (signals grouped by dataCategory, one line per coverage entry).

Grade logic is unchanged

Signals are display-only. They are never fed into overallGrade / verdict computation, which stays category-blind over all finding categories. All new code is presentation; no decision logic reads signals.

Validation actually run

• cargo fmt, cargo clippy, cargo test — pass. Pre-existing network-dependent test flakes noted (unrelated to this change).

Deploy ordering — read before merge

• The contract root is additionalProperties: false, so an older server would 400 a payload carrying the new fields.
• vettd must accept signals before this CLI version is released.
• Rollout sequencing: scanner tag v0.2.0 exists → the vettd PR (feat/issue-879-signals-ingest, contract 2.5.0) must land and deploy → then release this CLI version.
• Rollback: revert this branch once the server is on 2.5.0; the emitted-payload change is additive.

Contract sync note

The checked-in scanner-data-contract.json is not byte-identical to the server's file: the server's contract carries a detectedSource block that the CLI's compiled copy has never included (pre-existing divergence, present on main before this branch; not added or removed here). Everything else — including the new signals/coverage sections — matches exactly. Flagging rather than silently claiming full byte-identity.