feat(reports): bring the HTML report level with the other formats

[Chemaclass]

🤔 Background

Related #1251
Related #1252

Two gaps in one writer, the second found while verifying the first. Shipped together because they are the same file and the same theme — the HTML report lagging every other format — and their tests interleave. Happy to split if you would rather review them apart.

It said a test failed but never why. JUnit carries the message in <failure>, JSON in .message, TAP in its YAML block, Markdown in a fenced block. HTML — the format you open in a browser precisely to find out what broke — dropped it.

The summary did not count risky. A run of one passing and one risky test showed 2 total against categories summing to 1, with nothing on the page saying where the second test went. The row was there, coloured with the .risky class the stylesheet defines; only the numbers were missing.

💡 Changes

• A Failures section: name, file:line, assertion message, shaped like the Markdown report's. failed is the only status listed — a runtime error records as failed, and flaky passed, so its first-attempt message stays in JUnit's <flakyFailure> rather than under a heading that says Failures
• Risky and Flaky columns, using get_tests_risky/get_tests_flaky — both already existed and were never called
• Guarded at two levels, which the mutation test justifies: removing the risky data cell while leaving its header passes the header assertion and fails only the sum. Flaky is excluded from that sum because it stays inside the pass total, so adding it would double-count
• Also covered at the --parallel boundary, in the test file that exists for that regression class (fix(reports): every report format is empty under --parallel #1004): those arrays are filled inside per-test workers, which is exactly the shape that once came back empty while the run stayed green

Failure messages go through the escaping added in #1249, so a failure comparing <b>want</b> cannot inject markup — pinned by its own test.