GeezerVison

Before review: #398–#406 need rebasing onto this branch. #396 was rebased on Oct 28, but the PRs above it still carry the earlier copy of its commit (6b113c0 rather than 524856b). As a result, #398's diff repeats this PR's changes (16 files, +1,538), and #396 and #398 show conflicts with main. The conflicts are only in pyproject.toml, socketsecurity/__init__.py and uv.lock; the code merges cleanly.

Please fetch before rebasing: I pushed 697e2d3 to #399's branch. It puts back test_explicit_discovery_results_prevent_a_second_walk, which only failed because its stub had no html_report_url.

On the version: this branch sets 2.11.5, and main is already at 2.11.8. The stack adds new fields to the standard JSON output (#402, #403, #406), so it should ship as one minor release. Could you keep a single bump here at 2.12.0 and leave the version alone in the other PRs?

Also, #407 is built on #406's branch but isn't part of this stack. If it's meant to ship with the stack, please add it so it appears on the stack page.

Two follow-ups to my comment above:

• Correction: main is now at 2.11.11, not 2.11.8. The conflicts are still only in the version files.
• None of the PRs in the stack touch CHANGELOG.md, and the Public Changelog section here is still the template's N/A. This PR changes console output: diff runs now link to the comparison instead of the full-scan report, and clean runs print the link after No issues found. The rest of the stack adds JSON fields. Could you add a 2.12.0 section to CHANGELOG.md alongside the version bump?