feat: add package version column to the PR report table

[msoffredi]

Summary

• Adds version: string | null as a required field on PackageScore, matching the existing "always present, null means unknown" convention of generalScore/automationScore/riskScore.
• Threads it through score.ts's API-response parsing — GET /packages/:name on the package-rating API already returns version, so no upstream API changes were needed.
• Renders a Version column (right after Package) in report.ts's markdown table, using the file's existing '—' fallback convention for missing data.

Scope

Explicitly excludes (see design spec): reading the consumer's lockfile to report an actually-pinned version (vs. registry latest), and any package-rating admin UI changes. Both were raised and deliberately deferred during design.

Design docs

Spec and implementation plan live in msoffredi/package-rating:

• docs/superpowers/specs/2026-07-02-audit-action-version-column-design.md
• docs/superpowers/plans/2026-07-02-audit-action-version-column.md

Test plan

• Full suite: 41/41 passing
• Typecheck clean
• dist/ untouched (release workflow rebuilds it on tag push)
• Built via subagent-driven development: 2 tasks, each with independent implementer + reviewer passes, plus a final whole-branch review confirming the API-response → type → rendered-cell pipeline works end to end and no PackageScore construction site was missed across src/.

🤖 Generated with Claude Code