fix: improve actionable fix guidance for transitive dependency findings

[sonukapoor]

Replaces vague and misleading fix messages for transitive findings with honest, actionable guidance across all output surfaces.

Three tiers of improvement based on how much data is available:

• Tier 1 (parent + exact upgrade version known): already worked — fix plan emits npm install parent@version with a new Context column showing which vulnerable package is resolved
• Tier 2 (parent name known, no safe version found): getRecommendedAction, summarizeNextAction, and the fix plan skip reason now name the parent and say "no safe version was identified automatically — check for a release that resolves pkg to X+"
• Tier 3 (no dependency path at all): replaces the misleading "Upgrade the parent dependency chain" message with an honest "No dependency path found — inspect your lockfile"

Also extracts getPrimaryParent to src/utils/finding.ts so both the output and remediation layers can use it without a circular import, and fixes the urgent-section printer to render parent-upgrade targets with the Context column rather than silently merging them into the direct-upgrade table.

Closes #251

[Copilot]

Pull request overview

Improves user-facing guidance for transitive vulnerability findings by replacing vague/misleading upgrade instructions with clearer Tier 2/3 messaging, centralizing “primary parent” derivation, and improving how urgent fix-plan sections render parent-upgrade targets.

Changes:

• Extracts getPrimaryParent into src/utils/finding.ts and updates call sites to use it.
• Updates formatter and remediation messaging for transitive findings when no validated parent upgrade target is known (Tier 2) or no dependency path exists (Tier 3).
• Fixes urgent fix-command printing to render parent-upgrade targets in their own table with a Context column (rather than blending into the direct-upgrade table).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/output.test.ts	Adds/updates tests for getPrimaryParent, Tier 2/3 messaging, skip reasons, and urgent Context-column rendering.
src/utils/finding.ts	Introduces shared getPrimaryParent helper for finding dependency-path parent extraction.
src/remediation/fix-commands.ts	Improves skipped-reason text for transitive findings based on parent/path availability.
src/output/printers.ts	Updates urgent fix-plan printing to separate direct vs parent-upgrade targets and adds wider Context column support.
src/output/formatters.ts	Replaces formatter-level parent derivation and updates Tier 2/3 recommended/summary messages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.