fix: name matched risk inputs in policy scan banner and alerts (#1473)

The pre-deploy gate names the inputs that matched a scan policy (a
known-exploited CVE, a fixable Critical/High, or a severity threshold),
but the informational post-scan surfaces still framed every violation as
a severity ceiling. The scan detail banner read "blocks severities at or
above X, highest severity is Y" and the scheduled-scan alert read
"<severity> exceeds <maxSeverity>", which is wrong for a KEV- or
fixable-only policy that never gated on severity.

Persist the matched reasons on the policy evaluation, carry them on the
scheduled-scan violation, and render them on the banner so every policy
surface names the input that actually matched. Evaluations persisted
before this change carry no reasons: the parser defaults the field to an
empty array and the banner falls back to a plain violation notice.

frontend/src/components/VulnerabilityScanSheet.tsx

@@ -47,6 +47,7 @@ import { cn } from '@/lib/utils';
 import { cveUrl } from '@/lib/cveUrl';
 import { SEVERITY_ROW_TINT } from '@/lib/severityStyles';
 import { formatTimeAgo } from '@/lib/relativeTime';
+import { formatPolicyReasons } from '@/lib/policyReasons';
 import type {
   VulnerabilityScan,
   VulnerabilityDetail,
@@ -629,16 +630,13 @@ export function VulnerabilityScanSheet({
                     Policy violation
                   </div>
                   <div className="text-sm text-stat-value mt-0.5">
-                    <span className="font-mono">{scan.policy_evaluation.policyName}</span> blocks
-                    severities at or above{' '}
-                    <span className="font-mono tabular-nums">
-                      {scan.policy_evaluation.maxSeverity}
-                    </span>
-                    . This scan's highest severity is{' '}
-                    <span className="font-mono tabular-nums">
-                      {scan.highest_severity ?? 'UNKNOWN'}
-                    </span>
-                    .
+                    This scan violates{' '}
+                    <span className="font-mono">{scan.policy_evaluation.policyName}</span>
+                    {scan.policy_evaluation.reasons.length > 0 ? (
+                      <>: matched {formatPolicyReasons(scan.policy_evaluation.reasons, scan.policy_evaluation.maxSeverity)}.</>
+                    ) : (
+                      <>.</>
+                    )}
                   </div>
                 </div>
               )}