fix(cli): SSL/gRPC/traceroute — valid assertion builders, honest reporter, rich checks get [SIM-286][SIM-287][SIM-291]

[danielpaulus]

Completes SSL/gRPC/traceroute CLI support on top of #1362: assertion constructs emit backend-valid payloads, checkly test output is honest, and checkly checks get shows rich per-type detail. Stacked on feat/cli-pertype-result-rendering (#1362).

What changed

Assertion constructs (SIM-287)

• Traceroute responseTime() defaults property to avg + adds .avg()/.min()/.max()/.stdDev() (previously emitted an empty property the backend rejects → 400).
• SSL baseline severity 'warn' → 'degrade' (matches the backend enum).
• Add greaterThanOrEqual + matches builders (for KEY_SIZE_BITS / TLS_VERSION / CIPHER_SUITE / ISSUER_CN) and SSL sources OCSP_STAPLED / HANDSHAKE_TIME_MS / SAN_CONTAINS, all round-tripped through codegen.
• Shared degradedResponseTime ≤ maxResponseTime cross-field validation.

checkly test reporter (SIM-286)

• No longer renders assertions as green ✔ under a request error (nothing was evaluated).
• Humanized gRPC labels + response-time line; SSL response-time reason + security-baseline verdict.

checkly checks get --result (SIM-291)

• Adds the missing ASSERTIONS section for SSL/gRPC/traceroute via a shared renderer used by both checkly test and checks get (can't drift).
• Rich per-type detail: SSL CERTIFICATE (issuer/subject/validity/key/signature/SHA-256/SANs/serial/self-signed·CA/OCSP) + per-rule SECURITY BASELINE; gRPC TIMING (dns/connect/total); traceroute probe protocol + DNS timing.
• --output json unchanged (full result body).

Testing

• Unit: formatter (63) + reporter (36) tests; ssl-assertion-codegen, traceroute-assertion-codegen, grpc/ssl/traceroute-monitor specs; tsc clean. Reporter refactor is behavior-neutral (guarded by the unchanged reporter snapshot).
• Live (local devenv + a prod account), all three types, pass + fail: deploy + checkly test render typed blocks and ✔/✖ assertions with Received: (no green-on-error); checks get --result shows per-type CERTIFICATE/BASELINE/TIMING/hop-table + the new ASSERTIONS section; checks list/stats/delete/trigger work for the new types; --output json emits the full body. Prod run = 3 pass / 3 fail as configured, real 11-hop trace.
• Config coverage: 35 generated checks (14 SSL / 12 gRPC / 9 traceroute) exercising every property, config enum, and assertion source × comparator — all deploy clean.

🧪 Manually tested (live CLI runs)

Exercised end-to-end against a local devenv and a prod account, for SSL / gRPC / traceroute, pass + fail:

• checkly test — typed result blocks + ✔/✖ assertions with Received:, no green-on-error (prod: 3 pass / 3 fail as configured; gRPC HEALTH carried; traceroute real 11-hop trace).

• checkly checks get --result — SSL CERTIFICATE + per-rule SECURITY BASELINE, gRPC status/health/TIMING, traceroute hop table, all with the new ASSERTIONS section; also --stats-range / --group-by location.

• checkly checks list (table, --output md, filters), checks stats, checks delete, trigger — all work for the three types.

• checkly deploy — a 35-check exhaustive set (14 SSL / 12 gRPC / 9 traceroute) covering every property, enum, and assertion source × comparator deploys clean.

• --output json — full result body for agents.

• checkly import (reverse codegen) — generates valid SslMonitor / GrpcMonitor / TracerouteMonitor constructs from existing checks. This surfaced a backend gap where the import plan dropped the SSL/gRPC per-type config (both threw reading 'mode'/'hostname' before) — fixed in monorepo #2864 — then verified end-to-end on both a devenv and a prod account: the SSL/gRPC/traceroute constructs regenerate cleanly with full request.sslConfig/grpcConfig and assertions.