GeezerVison

A blocked developer only saw severity counts, so a false positive was
unactionable: nothing in the message identified which value tripped the
guardrail. List each distinct finding's type and value hash instead, which
is what `cycode ignore --by-sha` takes.

The hash is safe to display; the value is not. Detections already dropped by
an ignore rule are filtered out upstream in create_local_scan_result, so only
what actually blocked is listed. The two hook messages that interpolated the
summary mid-sentence now put it last, since it spans multiple lines.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

build_violation_summary sat in the shared utils/scan_utils.py but has only
ever had one caller, and it is now shaped for a hook message rather than a
terminal - multi-line, with a value hash per finding. Other scan commands
render through the printers, which already have their own Secret SHA column.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>