[thebenignhacker]

This pull request lands 3 commits in internal/cli, pkg/analyzer, pkg/reporter, pkg/scanner, pkg/types, docs, README.md, CHANGELOG.md and .goreleaser.yaml.

Included

• Write JSON severity by name, fix CBOM primitives and asset types, name skipped node_modules, cap the streamed list and plain help wording (Quality follow-ups from the 2026-10-16 new-user walkthrough (scan output, help text, formats) #7)
• Refuse an -update-capture directory whose last path element is not cryptoscan, and state the rule in the flag description (-update-capture writes a README block the test rejects unless the directory is named cryptoscan #31)
• List CryptoScan's own reports as not scanned, name a change in each dependency fix, and use current GoReleaser keys (Smaller fixes: scanner, docs, tooling (16 items) #23)

Verified on this exact tree

• go build -v ./...: exit 0
• go vet ./...: exit 0, no output
• go test -race -p 4 -count=1 -json ./...: exit 0; packages: 8 passed, 0 failed, 1 with no test files (pkg/version); top-level tests: 342 passed, 0 failed, 0 skipped; subtests: 782 passed, 0 failed, 0 skipped
• goreleaser check: "1 configuration file(s) validated", exit 0
• golangci-lint run --max-same-issues=0 --max-issues-per-linter=0 (golangci-lint 2.12.2, no repository config): exit 1, 88 issues (errcheck 48, staticcheck 40); on origin/main: exit 1, 85 issues (errcheck 45, staticcheck 40); the 3 more are errcheck reports on fmt.Fprintf in internal/cli/scan.go
• the same command with a config that enables only the exclusion presets comments, common-false-positives, legacy and std-error-handling: exit 1, 40 issues (staticcheck 40) on this tree and the same 40 on origin/main
• changelog: TestChangelogEntries and TestChangelogSaysWhereSARIFAndCSVCarryTheCryptoJSText in pkg/reporter passed in the test run above

Not included

• b353dbe (A .cryptoscan.yaml in the scanned tree can suppress every finding, and no output says so #9): changes the exit code of scan --fail-on and gate (exitCode in internal/cli/scan.go); not part of this batch
• 5611fdf (Code under examples, fixtures, testdata, docs and similar directories is never reported, with no notice and no flag #10): git merge-tree --write-tree --name-only --merge-base 881bc8f HEAD 5611fdf on this branch exits 1 with conflicts in CHANGELOG.md, README.md, docs/commands.md, internal/cli/scan.go, pkg/reporter/text.go and pkg/scanner/scanner.go

Closes

Refs #7
Fixes #31
Refs #23

How to merge

Rebase and merge, so that each change stays its own commit on main.