feat(health): "how to improve" engine + honest scoring on the health page #5439

The health page graded verom-ai-immigration-compliance D/45 and gave no path to change it, while contradicting itself three ways (Dependencies "100 — 0 deps" on a detected-Python repo; "Strong test suite" beside Testing 50; Security 0 from one repeated pattern).

Note: alters scoring semantics in §4.4-locked intelligence.ts, under the owner's explicit direction this session ("we need far better intelligence").

• computeImprovements() — ranked to-do list with exact overall-point gains, computed from the scorer's own constants so the advice can't drift. Rendered at the top of the page: "Completing everything below takes this repo from 45 to about 78/100."
• Security per-rule caps — medium 20 / high 40 per rule, criticals uncapped. 65 innerHTML hits no longer scores the same 0/100 as committed AWS keys.
• Dependencies honesty — pyproject.toml/Pipfile/Gemfile/composer.json are manifests now; when NO manifest exists the category reads "not scored" and weights renormalize instead of counting a perfect 100.
• Score attribution — every card shows "N of M possible overall points (weight X%)".
• Insights — praise only when the score agrees.

21/21 tests (new health-improvements.test.ts + existing intelligence suite), tsc clean.

🤖 Generated with Claude Code