test(web): cover buildSecurityScanFromFields verdict/risk/findings normalization

[dirtybits]

Summary

Adds direct behavioral test coverage for buildSecurityScanFromFields
(web/lib/securityScan.ts), the DB-row → user-facing security-verdict
transformer. The existing scan.test.ts covers the AI-side scanner
(scanSkillTree / ensureSkillScan / runScanSafe), and
trustSignals.test.ts only imports the SkillSecurityScan type —
there was no test exercising how a stored SkillScanFieldRow is
normalized, and how corrupt or unknown values are rejected.

Behavior locked in

• Verdict gating. A valid review row yields a fully normalized
  SkillSecurityScan. Verdicts outside the allowed set (undefined,
  null, "", safe, allow, ok, SAFE, pass) — i.e. anything
  the scanner contractually never returns — yield null, so a corrupt or
  unknown stored verdict cannot leak a bogus verdict into the rendered UI.
• Risk normalization. Valid low|medium|high risks are kept; unknown or
  missing risk collapses to null.
• Findings normalization.
  • Valid findings keep their fields; missing category/evidence/file
    default to unknown/""/SKILL.md.
  • JSON-string findings (the shape insertScan persists via
    JSON.stringify(scan.findings)) are parsed; non-array JSON, malformed
    JSON, and non-string/non-array values yield an empty findings[].
  • Non-objects in the findings array and objects with an invalid or missing
    severity are filtered out.
• Field coercion. truncated coerces via Boolean; scanned_at
  serializes a Date to an ISO string and nulls to null when missing;
  model/rubric_version/scan_source/generated_by_model apply their
  documented defaults; advisory is always true.

Verification

• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism
  — pass: 143 files, 1203 tests.
• npm run format:check — pass (all matched files use Prettier style).
• npm run lint:web — pass.
• npm run typecheck --workspace @agentvouch/web (next typegen && tsc --noEmit) — pass.
• Web build: not run locally; this is a test-only addition (1 new file,
  0 source edits) and the CI test job covers typecheck/lint/format/vitest.
  The Vercel build gate is the real web build gate per repo convention.

Scope

Exactly one new file, web/__tests__/lib/securityScan.test.ts, no changes
to web/lib/securityScan.ts or any other source. No in-flight PR touches
this file.

Signing

This headless cron run has no GPG signing key configured (git config user.signingkey empty). Per the established cron precedent, the commit is
unsigned; to sign-amend and re-push:

git commit --amend -S --no-edit && git push --force-with-lease