[thebenignhacker]

This pull request lands 3 commits in CHANGELOG.md, internal/cli, pkg/analyzer, pkg/reporter and pkg/scanner.

Included

• List the GoReleaser entry under the first "### Changed" of the unreleased changelog section (CHANGELOG [Unreleased] has two "### Changed" headings #46)
• List files with the same risk score in path order in topRiskFiles and the top priority files box (migrationScore.topRiskFiles orders tied files differently on each run #47)
• List the dependency insight's libraries in name order (The dependency insight lists its libraries in a different order on each run #48)

Verified on this exact tree

• go build ./...: exit 0
• go vet ./...: exit 0
• golangci-lint run ./... (golangci-lint 2.12.2): exit 1, 21 issues (errcheck: 15, staticcheck: 6)
• golangci-lint run ./... on origin/main 247a2e3 in a separate worktree: exit 1, 21 issues (errcheck: 15, staticcheck: 6); pre-existing
• golangci-lint run --max-same-issues=0 --max-issues-per-linter=0 ./...: 88 issues (errcheck: 48, staticcheck: 40) on this tree and 88 issues (errcheck: 48, staticcheck: 40) on origin/main 247a2e3; diff of the two issue lists with line numbers removed: no output
• golangci-lint run --new-from-rev=origin/main ./...: 0 issues
• go test -race -p 4 -count=1 -json ./...: exit 0; packages: 8 passed, 0 failed, 1 with no test files (pkg/version); tests: 1128 passed (346 top-level, 782 subtests), 0 failed, 0 skipped
• changelog tests in pkg/reporter/changelog_test.go (TestChangelogEntries, TestRepeatedChangelogHeadings, TestChangelogReleasesHaveOneHeadingPerKind, TestChangelogSaysWhereSARIFAndCSVCarryTheCryptoJSText): 4 passed in the run above

Not included

None

Closes

Fixes #46
Fixes #47
Fixes #48

How to merge

Rebase and merge, so that each change stays its own commit on main.