test(scanner): add comprehensive test fixtures and CLI integration tests

[NhanAZ]

What changed

• Added tests/cli/cli.test.ts to test the command-line interface entrypoint end-to-end.
• Added comprehensive edge-case fixtures: .env, .env.local, .env.example in ai-credentials fixtures.
• Added a python-pass.py test case for placeholder implementation with pass # TODO.
• Updated ROADMAP.md to check off the final task for v0.3.0.

Why

As the scanner adds more rules and functionality, testing individual rules directly is no longer sufficient. We need to verify that bin/opk routes arguments accurately, parses the JSON format when requested, enforces minimum severity thresholds, and manages non-zero exit codes when errors are discovered.
This ensures the scanner operates exactly as promised in the ROADMAP.md CLI contract without failing silently.

Verification

• Running npm test successfully executes 50 tests across 6 suites in < 1 second.
• cli.test.ts dynamically boots node bin/opk via execSync ensuring exact environment match.

This pull request completes all planned milestones for v0.3.0 - Polish.