fix(plugin): keep model-authored runtime status out of finalized reports

[russlan23]

Summary

Finalized reports can retain model-authored scope.runtimeStatus text that contradicts the finalizer-owned completed and sealed state. This removes that free-form field from the Markdown projection so lifecycle presentation has one authoritative source.

Fixes #687.

Changes

• Stop projecting scope.runtimeStatus into generated reports.
• Keep the field in the manifest and draft schemas for backward compatibility.
• Add a regression test that seals a scan containing stale pre-finalization narration and verifies the report omits it.
• Update the checked-in completed-scan report fixture.

Testing

• Focused finalization and report-projection tests: 2 passed.
• Complete plugin suite in Python 3.12 Docker with Git and ripgrep: 1,033 passed, 9 skipped, 103 subtests passed.
• git diff --check passed.

Risk and rollout

Low. This changes only deterministic Markdown presentation. Manifest data, schemas, artifact digests, CLI surface, and finalizer-owned lifecycle fields are unchanged. Existing runtimeStatus values remain readable by compatible consumers but are no longer presented as lifecycle status in regenerated reports.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.