feat: dependency risk scanner (nightshift deps)

[boldfield]

Summary

Add nightshift deps subcommand that scans Go module dependencies for security, maintenance, and license risks.

• Vulnerability scanning: Queries OSV.dev API with proper CVSS 3.1 vector parsing (computes base scores from vector strings per spec, not raw numeric scores)
• Maintenance health: Checks GitHub repos for archive status and commit recency
• License detection: Fetches LICENSE files from GitHub, classifies via SPDX keyword matching
• Error handling: API errors are surfaced to callers (not silently swallowed), partial results returned alongside errors
• Persistence: Results stored in dep_scans/dep_findings SQLite tables (migration v6)
• CLI output: Colored terminal output with lipgloss, JSON via --json flag, exit code 1 on critical findings

Iteration 3 fixes

• Fixed CVSS vector parsing: properly implements CVSS 3.1 spec formula using math.Pow for the impact sub-score exponent (was pow5, should be power of 13 for scope-changed)
• All three checkers (vulns, maintenance, license) now return errors to callers instead of silently succeeding
• Scanner returns partial results alongside errors for resilience

Test plan

• 17 unit tests pass across gomod, vulns, risk, scanner, and store packages
• Full project test suite passes (go test ./... — 22 packages)
• CVSS vector parsing verified against known vectors (9.8 critical, 8.8 high, 4.2 medium, 1.8 low)
• httptest-based tests for OSV.dev API interaction
• Store round-trip tests verify SQLite persistence
• Build succeeds cleanly