fix: add offline advisory db sync hint

[MFA-G]

Summary

• add actionable cve-lite advisories sync guidance when offline advisory DB initialization fails
• include --output <path> guidance when users pass a custom --offline-db path
• cover both default offline mode and custom DB path failures in CLI integration tests

Fixes #402

Verification

• npm test -- --runInBand tests/cli-integration.test.ts
• npm run build

[sonukapoor]

The string "To build it, run: cve-lite advisories sync" appears in both branches — it's the full else value and also the opening line of the if branch. If the command ever changes, it needs updating in two places. Worth extracting to a constant:

const BASE_SYNC_HINT = "To build it, run: cve-lite advisories sync";
const syncHint = options.offlineDb
  ? `${BASE_SYNC_HINT}\nOr to save it to the requested path: cve-lite advisories sync --output ${options.offlineDb}`
  : BASE_SYNC_HINT;

[sonukapoor]

The four options failOn, batchSize, searchDepth, minSeverity are identical across both tests. A shared object at the top of the block makes it obvious which option is actually under test in each case:

const BASE_SCAN_OPTIONS = {
  failOn: "critical",
  batchSize: "100",
  searchDepth: "4",
  minSeverity: "medium",
} as const;

// then per test:
options: { offline: true, ...BASE_SCAN_OPTIONS }
options: { offlineDb: "/tmp/custom-advisories.db", ...BASE_SCAN_OPTIONS }

[sonukapoor]

stripAnsi(result.stderr.join("\n")) is evaluated twice here (and again in the second test). Store it once so the assertions read more cleanly:

const stderr = stripAnsi(result.stderr.join("\n"));
expect(stderr).toContain("Offline advisory database is not available: file does not exist");
expect(stderr).toContain("To build it, run: cve-lite advisories sync");