fix: give --fix an honest, categorized summary of unapplied fixes

[sonukapoor]

Closes #974

The --fix summary lumped every not-auto-applied fix under a single "Skipped findings" line with a "v1 skip" jargon sub-bucket. On a project where nothing auto-applies (all findings transitive/breaking), a user stares at a report full of runnable fix commands, runs --fix, sees it apply zero, and gets an explanation that reads as broken.

Three real problems (verified against the code, credit to @Demiserular's analysis on the issue for surfacing them):

1. It implied a safe within-range refresh (parent-update) needed manual review the same as a breaking major bump (parent-upgrade) - they were both swept into one bucket.
2. The count was a misnomer: it counted deduplicated targets + skip records, not findings, so it contradicted the "Remaining findings after fix" line.
3. "v1 skip" is internal jargon that means nothing to a user.

What changed

• New categorizeUnappliedTargets splits not-applied fixes into within-range refreshes (safe to run), parent upgrades (need review, with a breaking major-bump sub-count via the existing isMajorVersionBump), and no fix available.
• The summary renders these honestly and drops the "v1 skip" / "Skipped findings" wording. The note explains --fix only auto-applies safe in-range direct upgrades and points to the Suggested Fix Plan for the rest.
• FixResultJson gains an additive notAutoApplied block so CI can read the structured breakdown without parsing stdout. Existing fields are unchanged.

Behavior is unchanged - this is a messaging-only change.

Before / After

Before:

No validated direct dependency fixes were eligible for auto-apply.
Fix summary
- Applied fixes: 0
- Skipped findings: 31
  - Transitive (v1 skip): 31
  - No validated direct target: 0

After:

No fixes were auto-applied. `--fix` only auto-applies safe, in-range direct-dependency upgrades. Review the Suggested Fix Plan above and run the remaining fixes manually.
Fix summary
- Applied fixes: 0
- Not auto-applied: 31
  - Parent upgrades (review + test): 27, 27 breaking
  - Within-range refreshes (safe to run): 3
  - No fix available: 1

Follow-up (not in this PR): within-range refreshes are marked "safe to run" but still not auto-applied - whether --fix should auto-apply them is a separate behavior change, tracked separately.

In-house fix (fix-runner / output internals).