Scan failures silently remove vulnerability evidence

[luojiyin1987]

Problem

Three defects cause scan failures to hide vulnerability evidence:

1. OSV detail lookup failure poisons cache. When getVuln fails transiently, the cache stores { vuln: null }. The next scan sees this as "confirmed clean" and skips retry.

2. 404 and negative cache silently drop advisory IDs. Advisory IDs from queryBatch that cannot be resolved are silently filtered out of findings. The scan appears clean.

3. Packument transient failures cached as missing forever. fetchPackument caches transient network failures as null, same as a confirmed 404. The package appears permanently missing.

4. Spinner misreports success. "Loaded N records" message counts all requested IDs, including failures.

Fix

PR #869 introduces:

• DetailCacheEntry.failed flag to distinguish transient vs confirmed failures
• Finding.unresolvedAdvisoryIds to preserve every unresolved advisory ID
• Packument cache eviction on transient failures (404 only persists as negative)
• Spinner reports actual success count

Related

• PR: fix(scanner): preserve evidence when advisory lookups fail #869
• Plan: docs/dev/scan-completeness-pr-plan.md

[sonukapoor]

Resolved by #869 (merged 2026-07-24). Transient advisory-lookup failures now retry and preserve evidence instead of being silently cached as a confirmed miss.