summit v0.9.5 - WAF detection, normalization, colored CLI, scan diffing

Anti-false-positive infrastructure and developer experience improvements.

WAF block detection (summit/waf_block.py)

New module that detects whether a probe response is a WAF/CDN block rather than a real application response. Checks 403/406/429/503 status codes, block-page body patterns, and WAF-specific headers (cf-mitigated, x-sucuri-id, x-iinfo, etc.). When a probe is blocked, vulnerability checks record an INFO note instead of reporting a false positive.

URL normalization (summit/normalize.py)

• Strips fragments, trailing punctuation, and duplicate slashes
• Sorts query params for consistent comparison
• Deduplicates findings by (check_id, host, evidence) with affected_urls[] merging
• Template sanity check: flags unrendered {placeholder} patterns in finding text

Colored CLI (summit/colors.py)

ANSI color codes for severity-tagged output: red for critical, yellow for high, magenta for medium, green for low. Phase names colored. Falls back to plain text when not a TTY.

Scan diffing (summit/diff.py)

summit diff <old.json> <new.json> classifies findings as new/resolved/unchanged/regressed using the dedup key. Useful for CI gating on new findings only.

Finding model (updated)

• confidence levels: confirmed > likely > needs-manual > info
• severity capping: unverified findings capped at LOW, likely findings capped at MEDIUM
• poc field: reproducible curl command
• verification_steps field: human verification procedure
• affected_urls field: deduplicated URLs merged into one finding

ruff clean. CI green on all workflows.