feat: add scoped --fix mode for validated direct remediation

[sonukapoor]

Summary:

• add --fix CLI mode with conservative v1 scope
• apply only validated direct dependency fixes using package-manager-native commands
• rescan automatically after apply and print concise applied/skipped summary
• keep transitive findings as skipped in v1 with clear wording
• add integration and arg parsing tests for --fix

Validation:

• npm test
• npm run build

Closes #125