fix(tests): use CVE-free fixture packages so clean-scan e2e tests don't depend on the advisory DB

[SAY-5]

Summary

Several e2e fixtures resolve real npm packages (lodash, express) and assert a clean exit, so a newly published CVE for the pinned version flips the scan exit code and breaks unrelated tests. This swaps those resolved packages for fixture-only names that no advisory can match.

Why this change

CI syncs the live advisory DB before the e2e suite, then runs scans with --offline. A fixture that pins lodash@4.17.21 / express@4.18.2 and expects exit 0 only stays green while no matching critical CVE exists in the DB. When one lands, the "clean" scan exits 1, which is what caused the 28 failures in the v1.25.0 release run (issue #726).

What changed

• Added SAFE_PKG / SAFE_PLATFORM_PARENT / SAFE_PLATFORM_BINARY constants to the e2e harness for fixture-only package names.
• Replaced the resolved lodash/express entries in clean-exit fixtures with those names (the override target gone and OA001 behaviour are unchanged; the orphan still fires because it is absent from the tree).
• Reworked the OA006 fixture onto a synthetic platform-binary pair; looksLikePlatformBinary() matches on the linux token, not the package identity, so OA006 still fires.
• The terminal-output test now keys off "Scan complete" (printed in every mode) instead of the "Summary" block that only renders when findings exist.

Validation

npm run build and npm test pass (851 tests). To confirm DB-independence I copied the synced advisory DB, injected a synthetic critical advisory for lodash and express, and scanned both old and new fixtures with --offline-db: the old fixtures exit 1, the new fixtures stay exit 0.

User-facing impact

Does this change:

• affect scanning behavior
• affect output formatting
• affect JSON output
• affect docs only

Test-only change; no runtime behaviour is affected.

Notes

Follows option 1 from the issue (fixtures use packages that cannot acquire advisories).

Closes #726