fix(report): report.json lost lockfileSource when it was unified with --json #1263

#1176 unified the HTML report's report.json with the --json payload, which was the right
move: the two had drifted into different shapes and now come from one builder.

One field was lost rather than renamed in the process. packageManager became source and
completeness flattened into complete / diagnostics / status, both of which carry the same
information under new names. But lockfileSource has no --json equivalent, so unifying to
that schema dropped it.

On examples/shrinkwrap, report.json on the previous shape carried
"lockfileSource": "npm-shrinkwrap.json". It now has no such key.

Why this is small but worth fixing

Nothing in this repository reads it, and the report page still renders it in the header and
footer because the page renders from the report data rather than from the payload. So nothing is
visibly broken. But report.json is documented as the --json schema plus a few additions, and
it is the artefact someone would script against if they wanted the richer shape, so quietly
having less than the page shows is the wrong direction.

What to do

Add it beside scannedAt and cliVersion in the jsonPayload block in
src/scan/single-scan.ts, so report.json is a strict superset of --json rather than a
superset-minus-one.

Then assert it. #1176's e2e test compares the key sets of report.json and the --json payload
for equality, so an additive field needs to be in the allowed-extras list rather than breaking
that test. Check which by running it, not by reading it.

npm test and npm run build before marking it done.