feat(diff): order report deterministically by risk (severity-first CVEs, stable component listing)

[dmchaledev]

Summary

diff() currently returns components and vulnerabilities in whatever order the source SBOM happened to list them. SBOM scanners do not guarantee a stable emit order, so today the report is non-deterministic run-to-run and not prioritised by risk. That directly undercuts the two headline use cases in the README — "perfect for CI/CD gates and audit trails" and "great for PR comments":

• Audit trails / committed reports / PR-comment diffs become noisy: re-running against a re-generated SBOM can reorder the whole report even when nothing actually changed, producing a misleading diff.
• Risk is buried: a critical CVE (e.g. Log4Shell) can be listed below several low ones, and a major version bump can sit beneath a pile of patch bumps. The most important signal isn't at the top where a reviewer looks first.

This PR sorts the report once, in diff(), so all three render formats (text / json / markdown) and direct programmatic consumers (report.newCVEs, report.added, …) benefit from the same stable, risk-first ordering.

Ordering rules

Section	Order
added / removed	name ascending, then version
upgraded	major bumps first (highest risk), then by name
newCVEs / fixedCVEs	severity descending (critical → none → unset), then by CVE id

Why this is the right layer

Sorting lives in diff.ts (not the reporter) so the ordering is consistent everywhere the ChangeReport is consumed — the JSON output used in CI and the objects accessed in the documented programmatic API are ordered identically to the rendered text/markdown.

Compatibility

Purely a reordering. The ChangeReport shape, field names, and counts are unchanged, so this is fully backward compatible — no behaviour change beyond the order of existing array elements.

Distinct from in-flight work

This touches only the ordering of the result and conflicts with none of the open PRs/issues in scope (which concern the --fail-on gate, CVSS extraction, markdown cell escaping, downgrade/purl matching, and license/validation/hash detection).

Tests

Adds 4 tests covering:

• added/removed sorted by name regardless of input order
• new CVEs ordered by severity, then id (with a tie broken by id)
• upgrades with major bumps surfaced first
• identical output for the same components supplied in different input order (the determinism guarantee)

All checks green locally: 33 tests pass, eslint src clean, tsc build clean.

🤖 Generated with Claude Code

---

Generated by Claude Code