fix!: only report a scan as secure when every check was graded

[neoarz]

A scan could print "SECURE 100/100" and exit 0 without checking the
target. Grader failures counted as refusals, failed probes were dropped,
a mistyped filter ran zero probes, and unset options swapped the target
model. #5 fixed the case where every call fails;
partial failures still passed.

• Add an "inconclusive" verdict for scans that found nothing but had
  turns or probes error, ran none, or aborted. It scores 0.
• Report per-mode coverage (graded checks, failed checks with their
  errors, and checks skipped by the time budget or an abort) and the
  model each role used.
• Let evaluator and judge failures surface instead of guessing from
  keywords, and ignore extracted text on "none" verdicts.
• Give each injection probe its own conversation, so the two halves of
  dual mode stop clearing each other's history and the injection
  transcript is kept.
• Stop unset scan options from overwriting the defaults.
• The CLI exits 0 when secure, 1 when vulnerable, and 2 when there is no
  verdict. Before scanning, it rejects unknown categories and
  severities, bad counts, a --duration too short to run anything, an
  unreadable --file, and an unwritable -o. It flushes stdout before
  exiting so piped --json output isn't cut off.
• Add an E2E suite (bun test) that runs the CLI against a local mock
  LLM. It needs no API key or network and saves each run to
  test/e2e/artifacts/.
• Run lint, typecheck, build, and the E2E suite in CI on every pull
  request. No API keys are needed, and the test artifacts are uploaded
  even when a run fails.

BREAKING CHANGE: overallVulnerability and injectionVulnerability can be
"inconclusive", and ScanResult has new required coverage and models
fields. Evaluator.evaluate and InjectionEvaluator.evaluate throw when
the grading model fails. Usage errors and failed scans exit 2 instead
of 1. createTarget defaults to anthropic/claude-sonnet-5 instead of
x-ai/grok-3-mini. runSecurityScan uses the documented defaults for
options left unset (models, inspector, orchestrator) instead of turning
them off.