fix(scan): count packages with unknownReason metadata as UNKNOWN

[v3nant]

Summary

• Restore correct EOL scan counts after the eol-api changed the component metadata shape: unknown/unresolvable packages now arrive as { unknownReason } instead of null.
• Without this, every unknown package was silently counted as "Not End-of-Life (EOL)" in scan output and in the eol_unknown_count analytics metric.

Changes

• Bump @herodevs/eol-shared from v0.1.20 to v0.1.23, which teaches deriveComponentStatus to treat { unknownReason } metadata as UNKNOWN and models the ComponentMetadata union (EolScanComponentMetadata | UnknownComponentMetadata).
• Update package-lock.json to the resolved v0.1.23 commit.
• Migrate test fixtures off the removed metadata: null shape to { unknownReason } in display.svc.test.ts and file.svc.test.ts.
• Add a regression test asserting components with only an unknownReason count as UNKNOWN and not OK.

Testing

• npm run typecheck — passes
• npm run lint — passes
• npm run test — 248 passed (24 files)

Screenshots

n/a

Risks & Rollback

• Low risk. The behavioral fix lives entirely in the @herodevs/eol-shared bump; the sole CLI consumer (countComponentsByStatus) delegates to the library and is otherwise unchanged.
• The GraphQL selection is unaffected — metadata is an opaque JSON scalar, so no query changes.
• Rollback: revert the @herodevs/eol-shared pin to v0.1.20 and the accompanying package-lock.json change.

Checklist

• Tests added or updated
• Linting passes
• Typecheck passes
• No breaking changes without clear migration notes
• Environment variables documented (if added/changed) — n/a