## Summary - add concise per-host summary sections to reports when input contains multiple hosts - keep existing detector thresholds and finding logic unchanged - make multi-host inputs easier to review without drifting into SIEM-like correlation ## Scope - summarize parsed events, findings, and warnings by hostname - preserve existing top-level summary and golden contract discipline - update golden outputs / regression fixtures accordingly - no enrichment, no cross-host correlation logic, no detector-policy changes ## Acceptance Criteria - `report.md` includes a compact host summary section when more than one hostname is present - `report.json` includes a stable host-summary object or array - existing global summary and finding objects remain backward-compatible where practical - golden report contract tests are updated and remain deterministic
