refactor(fail-on): share the gate-class labels between the two scan paths

[Souptik96]

What changed and why

The single- and multi-folder scan paths each typed the three --fail-on gate-class labels as string literals. One path's wording could change without any test noticing.

• src/utils/severity.ts: export GATE_CLASS_LABELS next to failingGateSummary.
• src/scan/single-scan.ts and src/scan/multi-folder-scan.ts: both call sites now build their gate input from it.
• Tests:
  • tests/cli-integration.test.ts (single-folder) and tests/multi-folder-scan.test.ts (multi-folder) each get a test that trips all three classes. Each asserts the printed gate line against GATE_CLASS_LABELS, not a hand-typed copy. The single-folder test needed a detectDM001 module mock in that file. Its default returns [], so no existing test changes behaviour.
  • tests/utils/failon-gate-summary.test.ts pins the wording itself, once.

Gate behaviour, exit codes and printed text are unchanged.

The check from the issue. I replaced each label at each call site with a literal, one at a time (6 mutations: 3 classes × 2 paths). Every mutation fails exactly one of the new tests. Changing the shared constant fails the pinning test.

Verification. npm ci, npm run lint:tests, npm run build, node dist/index.js advisories sync and npm test were run on Windows (Node 22).

• On unmodified main, the suite has 64 failures.
• On this branch it has the same 64, plus 3 new passing tests.
• The 64 are Windows-specific and unrelated to this change. One example: an e2e test saves a temp caCert path into the real ~/.cve-lite-cli/config.json, and later e2e runs then fail on it. I can file that separately if it's useful.

Closes #1274

[prx-my]

Heads-up: this branch is currently behind main, which blocks the merge. Could you update it?

• Click Update branch on this PR, or
• Rebase locally:

  git fetch upstream
  git rebase upstream/main
  git push --force-with-lease
  

Once updated, CI will re-run. Thanks!

[Souptik96]

Rebased onto current main (1c5e893, no conflicts). The --fail-on gate tests and the new label tests pass locally. Thanks for the heads-up.