fix(scan): emit audit log events for multi-folder scans

[kocaemre]

What changed and why

Multi-folder scans now write audit-log coverage when --audit-log is enabled.

This closes the silent no-op path for monorepo scans by:

• passing the CLI audit-log handle into the multi-folder scan path
• emitting a multi-folder scan.started event with folder count and flag context
• emitting scan.finished with the final exit code and finding count
• using the same audit-log handle for per-folder override hygiene, so oa.detected events are written when --check-overrides is enabled

Closes #879

Verification

npm test -- --runTestsByPath tests/multi-folder-scan.test.ts
npm test -- --runTestsByPath tests/audit-log/integration.test.ts tests/overrides/api-audit-log.test.ts
npm run build
npm run lint:tests
git diff --check

Manual audit-log smoke test:

node dist/index.js examples \
  --offline-db tests/fixtures/advisories/seeded.db \
  --audit-log "$audit" \
  --json \
  --min-severity low

Result:

exit=0
2 audit.ndjson
scan.started
scan.finished

Scope notes

This PR is limited to the multi-folder audit-log behavior for #879. It does not change SARIF/CDX support, report JSON behavior, or the unrelated #877/#878 docs/report issues.

[kocaemre]

Closing this because I missed the existing overlapping PR #887 for the same multi-folder audit-log lifecycle path. I do not want to add duplicate review noise.