fix: refactor transitive risk message for clarity and reuse

[NBlaze860]

What changed and why

Extracted the duplicated transitive-risk message construction in summarizeRisk into a small transitiveRiskMessage helper. Both branches now use the helper with the appropriate package name and coverage status.

This is a pure DRY refactor.

Closes #1003

[sonukapoor]

This is a clean extraction - exactly the dedup #1003 was after, and the output stays byte-identical so the existing summarizeRisk tests still cover it.

One tiny thing before I merge, since we don't have auto-formatting set up yet: could you align the ternary indent in the new helper to match the rest of the file? The ? and : should sit at 4 spaces (they're at 6 right now). Once that's tidied it's good to go.

And if CVE Lite CLI has been useful to you, a star on the repo genuinely helps other developers find it - no obligation at all. Thanks for taking this one!

[NBlaze860]

@sonukapoor thanks for the review! I’ve made the requested indentation changes to the ternary in the new helper.

Kindly review it when you get a chance. Looking forward to contributing more to CVE Lite CLI!

[sonukapoor]

Clean refactor - the duplication was real and the helper handles both branches correctly. Nice one.

[sonukapoor]

Merged - thank you @NBlaze860!

[sonukapoor]

Clean DRY extraction, no behavior change. Good work!

[sonukapoor]

Merged - thank you @NBlaze860!