summit v0.9.2 - phase engine crash fix, complete CWE/IMPACT coverage

Stability release. The phase-based engine introduced in v0.9.0 was completely broken - it crashed every time it was used. This release fixes that and proves the fix with a comprehensive 12-point functional audit.

Fixed

• PhaseEngine runtime crash: phases.py used from .crawl.spider (single dot) but crawl is at summit/crawl/, not summit/scan/crawl/. Fixed to from ..crawl.spider. This was a silent crash - the phase-based engine existed in the codebase but never actually worked.
• headers-grade empty CWE: changed from empty string (falsy) to CWE-693.
• captcha-challenge empty CWE: changed from empty string to CWE-807.

Functional audit: 12/12 checks verified

Audit	What it verifies	Result
PhaseEngine	produces findings + technologies, 3 phases, durations	102 findings, 5 technologies
Severity filter	no leaks (critical stays critical)	4 critical, 17 high
No duplicates	no (check_id, url, param) duplicates	102 unique
CWE + IMPACT	populated for every finding	100% coverage
No FP	healthy control link stays unreported	zero FP
SARIF/JUnit	roundtrip valid	SARIF 2.1.0 + JUnit XML
Race condition	concurrent testing works	no-race (expected)
TLS audit	graceful error on HTTP-only target	ConnectionError caught
Min-severity	rank-based filtering correct	31 findings >= medium
CWE + IMPACT for all check_ids	every check_id has both	53/53
Evidence not truncated	as_dict and console return full strings	102 findings verified
Smart prioritizer v2	tech-aware scoring works	Python 3.13.2 detected

Coverage

• 88 tests, ruff clean
• 53/53 check_ids have CWE mappings (100%)
• 53/53 check_ids have IMPACT statements (100%)
• 35+ technology fingerprints in the fingerprint database
• 9 products in the CVE database with range matching
• 6 CI workflows all green

Authorized testing only.