[P2] Preserve generation time and checker identity in CSV exports #10

Audited commit: 9b603d37d15f259189a3df030a7d210366aec9b8. Priority P2. Audit criteria E (dated, reproducible evidence and tool provenance) and F (consistent report formats). This is a reporting defect, not an exploitability claim.

Observed behavior

The CSV columns omit the tool name, tool version and generation timestamp. write_report puts tool, tool_version and timezone-aware generated_at in JSON, and HTML has a generated time and tool footer, but CSV result and empty-summary rows discard that provenance. The CSV retains rules_as_of; that date describes the advisory snapshot, not when a supplied version was assessed.

Safe reproduction

Run these with a synthetic reported version; all operations are offline:

python tinypool_options_rce_check.py --version 2.1.1 --format json
python tinypool_options_rce_check.py --version 2.1.1 --format csv

JSON identifies tinypool-options-rce-check version 1.0.0 and includes generated_at. The CSV header has none of those three fields. This also affects the summary written when an interrupted run completes no observations. Existing tests pass because they assert assessment/completeness parity, not provenance parity.

Consequence and expected behavior

A detached CSV cannot establish which checker version produced the observation or when the assessment was made. A reader can mistake the rule verification date for current assessment time. This breaks the requested evidence trail even though the version conclusion is correctly unknown.

Build a single run-metadata envelope and preserve its tool identity/version and UTC generated time in every export, including zero-result/incomplete summaries. Keep rule-verification time separate from assessment time and from actual evidence acquisition time, which remains unknown unless provided by the operator. Use an injected clock in tests so format comparisons remain deterministic.

Acceptance criteria

• CSV result and summary rows preserve tool name, tool version and timezone-aware UTC assessment/generation time.
• JSON, CSV and HTML consume the same captured run metadata rather than independently inventing dates.
• Rule-verification date remains a distinct field and is never represented as acquisition time.
• Synthetic complete, empty and interrupted cases verify provenance parity and unchanged conservative statuses.
• Update CLI/reference/examples and run the existing offline suite without adding network access.

The Node reference explains the distinction between generated_at and rules_as_of. Primary vulnerability sources remain the maintainer advisory and reviewed advisory.

Deduplication: captured all-state issues #1-#9 and open PR inventory were reviewed. Closed interruption/publication issues do not cover missing export metadata; there are no open PRs. The existing 19-test suite passes.