fix(package): correct mislabeled header in deep score markdown

[John-David Dalton (jdalton)]

What

socket package score --markdown printed ### Capabilities twice in the Transitive Package Results section, back to back. The first one was mislabeled — its body is the lowest-scoring package per score category, not capabilities.

This renames that first header to ### Lowest Scoring Package Per Category, so the two sections are distinct and each header matches its body.

Fixes #1356.

Why

The duplicated heading is confusing in the rendered report (and produces duplicate anchors). The mislabel also means the report claimed a "Capabilities" section that actually described low-scoring packages.

Change

Before / after (transitive section)

Before:

### Deep Score
...
### Capabilities          ← wrong label
These are the packages with the lowest recorded score. ...
- Overall: npm/shell-quote@0.0.1
...
### Capabilities          ← real capabilities
These are the capabilities detected in at least one package:
...

After:

### Deep Score
...
### Lowest Scoring Package Per Category
These are the packages with the lowest recorded score. ...
- Overall: npm/shell-quote@0.0.1
...
### Capabilities
These are the capabilities detected in at least one package:
...

• src/commands/package/output-purls-deep-score.mts — rename the header string.
• Updated the affected inline snapshots in the two deep-score output tests (npm/go/ruby + nuget/maven/python), which assert on the exact markdown.

Testing

• vitest run test/unit/commands/package/ — 144 passed.
• pnpm run lint <file> — passed.
• tsc -p tsconfig.json --noEmit — no errors in the changed file.

One unrelated pre-existing failure (test/unit/constants.test.mts > has correct path properties) is present on a clean origin/main too (environment-dependent path assertion); not touched by this change.

---

Note

Low Risk
String-only markdown heading change with snapshot test updates; no scoring or API behavior changes.

Overview
Fixes duplicate ### Capabilities headings in the transitive section of socket package score --markdown output.

The block that lists lowest-scoring packages per score category (after Deep Score) is now titled ### Lowest Scoring Package Per Category, so it no longer shares a heading with the real capabilities list. Unit test inline snapshots were updated to match.

^{Reviewed by Cursor Bugbot for commit c25647a. Configure here.}

[John-David Dalton (jdalton)]

CI note (both red checks are pre-existing, not from this PR):

• 🔎 Check — fails on unrelated oxlint findings in scripts/repo/stage-publish-cli-exe.mts ("unnecessary assertion"). Already red on origin/main (the Check job on the latest main commit fails identically); this PR does not touch that file.
• 🧪 Test — fails only on test/integration/cli/cmd-ci.test.mts > socket ci (a branch-name-dependent banner snapshot). It fails on every non-main PR regardless of contents.