feat: state package-level static scope on every comparison output

[rogerdigital]

Acting on the first external pilot reply (pan17/dsh-wechat#7): the package-level-static-only scope was stated only inside coverage.limitations; the maintainer asked for it visible on the result itself.

Every dsh-vet diff human output and every PR comparison section — comparable and incomparable alike — now carries:

Scope: package-level static behavior only — behavior that depends on the composed DSH profile or host version is not visible from the package alone.

Same sentence across the CLI renderer (src/render-diff.ts) and the Action's dependency-free renderer (action/scripts/render.mjs); tests assert it on both paths; the pilot record's action item marked addressed.

Verification: pnpm verify — 196 tests across 17 files, typecheck, build, and package checks pass.

[github-actions]

dsh-vet report

Grade: A · coverage: unknown · audited dsh-vet · run · report uploaded as the dsh-vet-report artifact

critical	high	medium	low	info
0	1	0	1	2

Findings

• [H] egress.secret-adjacent — Network calls reachable from code that reads secrets (low confidence)
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
  • lib/index.mjs:2056 — ``${homedir()}/.dsh,
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
• [L] perm.undeclared-fs-write — Write/delete target is a runtime value — scope not statically verifiable (low confidence)
  • lib/index.mjs:843 — writeFileSync(abs, data);
  • lib/index.mjs:845 — if (mode & 73) chmodSync(abs, mode);
  • lib/index.mjs:921 — rmSync(dir, {

2 info findings (never affect the grade)

• perm.network-client — Opens network connections
• perm.subprocess-spawn — Spawns subprocesses

---

Findings are signals, not verdicts — a low-confidence finding never lowers a grade. A finding you believe is wrong? Open a public dispute.