fix(cli): preserve full per-skill JSON payload in recursive scans (#228)

[rodboev]

Summary

skillspector scan --recursive --format json currently reduces each successful skills[] entry to a summary row and drops the full per-skill report contract that single-skill JSON already exposes. This rebases the branch onto current main, preserves the recursive JSON contract for integrations by embedding the full per-skill payload, and keeps current main's combined-file behavior for recursive non-JSON --output.

Closes #228

Root cause

_scan_multi_skill() already has the full graph result for each skill, including the rendered JSON report_body. The recursive JSON writer rebuilds each skills[] entry from only name, path, risk_score, risk_severity, and finding_count, so the richer per-skill JSON document is discarded before the combined file is written.

The branch had also diverged from current main's CLI ownership: cleanup now lives in skillspector.cleanup.cleanup_result, the risk threshold comes from constants.RISK_THRESHOLD, and recursive non-JSON --output uses the combined-file writer already on main.

Diff Notes

• Rebase onto current main, keeping the existing _result_body() helper and concatenated non-JSON --output writer.
• Preserve current-main cleanup and risk-threshold ownership while replaying only the recursive JSON payload behavior.
• Parse successful per-skill JSON report_body values and merge them into each successful recursive skills[] entry while retaining the compatibility summary keys.
• Keep per-skill error entries unchanged.
• Update CLI regressions for recursive JSON fidelity, single-skill preservation, and recursive Markdown --output file behavior.

Scope

This stays on the CLI/report-contract boundary. It does not change analyzers, report-node schema, SARIF output, structured-skill discovery, baseline threading, provider behavior, or non-recursive output.

Verification

• pytest tests/unit/test_cli.py - pass, 12 passed
• ruff check src/ tests/
• ruff format --check src/ tests/
• Invariant enumeration gate - pass, 10 rows, state domains checked
• Local adversarial review - no findings
• CI Lint & Test (Python 3.12), Lint & Test (Python 3.13), and DCO Check - pending maintainer approval and rerun after push

[rng1995]

The JSON payload implementation is sound on this branch's base, but the PR conflicts with current main and its non-JSON regression test locks in behavior that main has since fixed. Rebase, preserve current main's combined-file behavior for recursive non-JSON --output, integrate the JSON payload work, and rerun the CLI suite.

[rng1995]

[Automated SkillSpector Review]

Re-review: still requesting changes. The stale non-JSON regression is corrected and the recursive JSON payload logic looks sound, but GitHub still reports the branch as conflicted with current main. Rebase and preserve main’s centralized cleanup and risk-threshold changes, then rerun the CLI suite.