refactor: collapse scanner boilerplate via runScanner + scanAll

[mulhamna]

Summary

• Collapse ~475 lines of duplicated scanner boilerplate with no behavior change.
• Bundle the open dependabot dev-dependency bumps (eslint, prettier) — supersedes chore(deps-dev): bump prettier from 3.8.3 to 3.8.4 #76 and chore(deps-dev): bump eslint from 10.4.1 to 10.5.0 #78.
• Add a Makefile so the verify chain runs with one command.

Changes

• src/utils.js — new runScanner helper (shared binary resolve → exec → parse, plus the permission/timeout warning contract). Moved getCliOptionValue / hasCliFlag / optsOf here (were duplicated across audit.js and upgrade.js).
• src/scanners/* — 32 exec-and-parse scanners reduced to command + parse. The 6 filesystem / multi-step scanners (cargo, dnf, go, gradle, maven, nuget) are intentionally left as-is — forcing them into the helper would hurt readability.
• src/index.js — extract scanAll / resolveScanners; adopted in audit.js and upgrade.js.
• src/upgrade.js — inline the trivial bucket summary. src/ports.js — drop a dead parseMacPorts regex branch.
• Makefile — make verify = format:check + lint + test.
• AGENTS.md / GEMINI.md — agent guides; ignore local .claude dir.
• deps — chore(deps-dev): eslint 10.4.1 → 10.5.0, prettier 3.8.3 → 3.8.4.

Test plan

• make verify (format:check + lint + test) green
• node --test — 12 tests pass
• Smoke: pkgmap, pkgmap -m npm, pkgmap audit -m npm --json, pkgmap ports --json, pkgmap upgrade -m npm --dry-run
• npm run release:check

Supersedes dependabot #76 and #78 — both bumps are bundled in this PR.