advisory-scan: report UNKNOWN, never 0, when a count could not be determined

Operator: 'the scanner should not say 0 when it was not able to scan.' Correct — the
previous patch still led with '0 identified' and relegated the caveat to a footnote,
so the headline number was wrong even though the prose was right. A 0 in a security
column is an assertion of safety; it must never be emitted for an undetermined result.

Now: cve_count_fixed is null (not 0) in JSON, a count_known flag distinguishes
'counted zero' from 'could not count', and the markdown headline reads
'CVEs fixed by this upgrade: UNKNOWN — the scan could NOT determine a count' with an
explicit 'This is NOT zero' and instructions to render '?'.

Verified: discourse 3.5.3 -> 2026.7.1 (semver->calver) now reports UNKNOWN; gitea
1.27.0 -> 1.27.1 still reports 2.

.claude/skills/recipe-report/SKILL.md

@@ -47,9 +47,13 @@ keeps every weekly edition looking the same regardless of which model writes the
        (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea
        RCEs were reported as "none" on 2026-08-07.
      - **`?` must stay RARE — it means "we tried and could not tell", not "we didn't look".** Use it
-       ONLY when a scan ran and reported genuinely failed sources. In particular: a recipe with **no
-       upgrade this run** (up-to-date/skipped) has nothing an upgrade could have fixed — report `0`,
-       not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan
+       ONLY when a scan ran and reported genuinely failed sources, **or when the scan block says
+       COUNT UNKNOWN** (it refuses to classify across a version-scheme change, e.g. semver → calver —
+       discourse 3.5.3 → 2026.7.1). In that case the scan's `0` means *not determined*: publish `?`
+       and say so in the notes; publishing `0` would assert a clean bill of health nothing supports.
+       (The scan headline itself now says `UNKNOWN` rather than a number in that case.)
+       In particular: a recipe with **no upgrade this run** (up-to-date/skipped) has nothing an
+       upgrade could have fixed — report `0`, not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan
        block (`no-advisories-published`, `skipped: template URL`) are NOT failures and must not
        trigger `?`. If you find yourself rendering `?` for many recipes, that is a bug to report in
        the Addendum, not a normal outcome.