fix(security): relabel unchanged bucket for cross-image comparisons (#662)

When comparing scans from two different image refs, same-CVE+package
matches are not necessarily the same finding. Relabel the pill and
row status from 'Unchanged' to 'Shared' in that case to convey that
the caveat in the warning banner applies.

frontend/src/components/ScanComparisonSheet.tsx

@@ -241,9 +241,14 @@ export function ScanComparisonSheet({
                 size="sm"
                 className="h-7 text-xs px-2.5"
                 onClick={() => { setFilter('unchanged'); setPage(0); }}
+                title={
+                  crossImage
+                    ? 'Same CVE and package name appear in both images. Because the images differ, this does not necessarily mean the finding is literally unchanged.'
+                    : 'Findings present in both scans'
+                }
               >
                 <Equal className="w-3 h-3 mr-1" strokeWidth={1.5} />
-                Unchanged ({data.unchanged.length})
+                {crossImage ? 'Shared' : 'Unchanged'} ({data.unchanged.length})
               </Button>
               {needsPagination && (
                 <div className="flex items-center gap-1 ml-auto">
@@ -349,7 +354,7 @@ export function ScanComparisonSheet({
                               {filter === 'unchanged' && (
                                 <span className="inline-flex items-center gap-1 text-muted-foreground">
                                   <Equal className="w-3 h-3" strokeWidth={1.5} />
-                                  Unchanged
+                                  {crossImage ? 'Shared' : 'Unchanged'}
                                 </span>
                               )}
                             </TableCell>