fix(cli): count only the transitive findings the report carries

[rodrigorjsf]

Closes #130.

Read this first: the issue's premise does not reproduce on this tree

#130 frames the over-count as a live, user-visible defect — "a --transitive run with a
--baseline that accepts a transitive finding publishes 2 and reports 1", reachable from an ordinary
invocation. That measurement was true when the issue was written and is not true now. Upstream
73dd1f1 ("Security fixes", NVIDIA#393) narrowed what the report node writes into filtered_findings to
the kept side alone, so the state the transitive count reads no longer carries the suppressed
findings it was over-counting.

The fix still lands, and the contract test still earns its place — it induces the pre-73dd1f1
shape deliberately, through a spy, because that shape is exactly what the transitive merge path
hands over today even though the report node no longer produces it. What changes is the framing: this
is a latent contract defect held shut by an upstream change, not a bug a user hits this afternoon. A
reviewer should know that before reading the diff, and #130 gets a comment saying so.

What lands

The over-count, first, as the brief sequenced it. 5e149c4 makes the transitive finding count
count only the findings the report carries. A failing test came first, as the brief required.

The redundancy, second and separately. 1b89e97 leaves exactly one function in the package
deciding which findings a finished Scan reports. #130 measured the fork's reported_findings and
upstream's effective_findings diverging on the raw-findings fallback — the fork's subtracted
suppressed_findings, upstream's deliberately did not. Upstream's semantics won, per this fork's
standing rule that upstream owns the truth about the core, so the fork's function became a
delegation and the reasoning it carried moved to the function that answers.

Review, and what the critics changed

Three independent critics graded this branch — acceptance-criteria conformance, scope and contract,
adversarial correctness. Zero blocking findings. Three of their non-blocking findings were promoted
by the main thread and closed here, because each is a claim that is not true:

The AC-4 assertion was true of itself. test_the_budget_and_the_summary_count_one_result_identically
compared _multi_skill_public_record_count(result) - 1 against len(reported_findings(result)) —
and that right-hand side is character-for-character the production expression at the call site the
acceptance criterion names. A critic proved it: inlining a raw filtered_findings read at
_combined_skill_entry's finding_count — precisely the regression this issue exists to prevent —
left every case green. e9f2b25 routes the comparison through _combined_skill_entry instead and
derives the suppressed record count from the state rather than hard-coding 1. Re-proved by mutating
that one site: now red, restored by hand, git diff --exit-code clean.

Three docstrings still asserted the falsified premise. 1b89e97's body claims the stale claim
lived in three places and "all three are corrected here". Four survived. 199f555 closes them.

A contract document stated a rule the tree does not keep. The new filtered_findings row in
docs/DEVELOPMENT.md ended "Read it through suppression.effective_findings, never directly".
Three legitimate mid-graph reads contradict the absolute, and the row described only what the report
node writes while the transitive merge writes the pre-partition merged population into the same
key beforehand. Now qualified at both ends: what the key holds at each point, and a rule that binds
the consumer asking which findings does a finished Scan report rather than the merge path, which
reads it before anything has been partitioned.

Deliberate deferral, filed rather than buried

reported_findings is now a one-line delegation, so one selection has two names and six call sites.
Removing it is a mechanical change with its own review surface and was deliberately sequenced after
the defect fix. Filed as #140 rather than left in a commit body, per CLAUDE.md's standing rule.
#140 also records the argument for keeping the name, which is not obviously wrong.

Verification

Run in the main thread on this branch, at e9f2b25:

make test-unit      4424 passed, 14 skipped, 38 deselected, 4 xfailed
make lint           All checks passed!
make format-check   258 files already formatted
make update-snapshots + git status --short   -> clean, no churn

Zero snapshots moved. This change is entirely in the CLI's and the report node's reader
functions; the Behavior Snapshot projection scans through the graph and its recorded state is
untouched.