feat: readable output for scan, diff-logs and generate - #3

What

scan, diff-logs and the generate summary get the same readable treatment as lint (PR #2): multi-line grouped output, file:line with a source snippet, category icons, counts and colour.

• scan: directives grouped by file, each with its icon (🌐 net, 📁 fs, 🔑 env, ⚙️ exec, 📝 directive), reason, --> file:line and the source line. Footer: ✔ 8 directives in 4 files and counts by category.
• diff-logs: sections by action (missing directives, binary not covered, L7 rules too narrow, manual review, 🧹 stale, declined, not actionable). Each fix is previewed as an inserted + line above the line --write would use (with the file's own comment leader), plus = why: / = where: / = add:. Footer counts suggestions and names the follow-up --write command.
• generate: the policy YAML on stdout / -o FILE is byte-identical for every format. The readable summary goes to stderr: rules with endpoints, access, binaries and the file:line they came from, filesystem roots, providers (and unmapped), process, wrapped warnings.

Flags (shared with lint)

--format human|json|compact (default human), --color auto|always|never (honours NO_COLOR, CLICOLOR_FORCE, TERM=dumb; for generate the colour decision follows stderr), --no-icons / --ascii (also automatic for non-UTF-8 locales).

• --format compact is the previous output, byte for byte (checked against the old binary for scan and diff-logs, and for generate's stderr).
• --json stays an alias for --format json (conflicts with --format). generate --format json prints a JSON summary on stderr.
• Exit codes do not depend on the format.

Other

• src/render.rs (new) holds the three renderers; report.rs only exposes a few helpers.
• Docs: README section with samples, docs/CLI.md regenerated, AGENTS.md note; the AI skill now uses --format compact for scan and diff-logs (parsing).
• Separate commit: fixes the clippy needless_late_init hit by the newer stable toolchain in src/directive.rs (pre-existing on main).

Checks

• TOOLCHAIN=1.94 scripts/ci-local.sh passes (fmt, clippy -D warnings, 46 integration tests + unit + docs tests, docs check); cargo +stable clippy --all-targets -- -D warnings clean.
• New tests: plain and colour snapshots (tests/golden) for scan, diff-logs and generate summary; byte-identical policy for every format and with -o; compact/json stability; colour and ASCII flag/env matrix for all three commands.
• Fixtures repo (no sandbox): 116 pass / 0 fail, identical to the run with the previous binary.