fix: multi-folder --json writes a timestamped file like single-folder

[Ayush7614]

Summary

• Multi-folder --json now writes cve-lite-scan-<ts>.json to the working directory and prints the saved path (same contract as single-folder writeOutputs).
• Keeps the multi-folder payload shape (multiFolder, per-folder subfolder tags, optional OA/DM).
• Updates docs that taught cve-lite . --json > file (nx-workspaces.md, workflow-integration.md) so redirects are no longer recommended.

Why

Help text says --json saves a timestamped file. Single-folder does that; multi-folder previously dumped JSON to stdout only. Unifying on the file-write contract also closes the docs/redirect footgun called out in #877.

Test plan

• npm test -- tests/multi-folder-scan.test.ts
• e2e multi-folder --json reads the written file
• npm run build
• Docs no longer show --json > … in NX or workflow-integration examples

Closes #877

[sonukapoor]

Thanks for taking this on @Ayush7614. The mechanism is right, and I like that you carried the maintenanceFindings / overrideFindings spreads over untouched rather than restructuring them. The tests are solid too: writing to a real temp cwd and reading the file back instead of asserting on the console.log call is exactly the right way to prove this, and catching that the file lands in process.cwd() (not the scanned project dir) in the e2e test was a good catch.

Two things before I can merge:

1. Could you add Closes #877 to the PR body? Right now it is not referenced anywhere in the description, so merging will not auto-close the issue.
2. I dogfooded a real redirect (cve-lite . --json > out.json) on a monorepo fixture and out.json just contains the text JSON saved to cve-lite-scan-....json, not the payload. That is expected given the design, but it is the exact pattern #877 calls out, and website/docs/workflow-integration.md (around lines 211 and 218) still shows cve-lite . --json > cve-lite-report.json. Since multi-folder used to print real JSON to stdout, that redirect actually worked before this change and is only broken now for multi-folder as a side effect. Could you update those two examples too, or note explicitly that they are being left for a follow-up? I do not want to close #877 while one of the two doc locations it names still teaches the broken pattern.

Everything else looks good, happy to merge once those are sorted.

[Ayush7614]

@sonukapoor thanks for the review — addressed:

1. Added Closes #877 to the PR body.
2. Updated both --json > … examples in website/docs/workflow-integration.md so they no longer teach stdout redirects.

Also rebased this branch onto latest main.