Four CLI tests assert a warning on the combined stream, so none pins the channel

## Problem

Four CLI tests assert a `warning:` line against `result.output`.
On `click` 8.4, `Result.output` holds stdout and stderr together, so
the assertion passes whichever stream carried the line. None of the
four pins the channel ADR-0011 decision 1 assigns.

## The sites

- `tests/unit/adapters/test_cli_scan.py:390` — `"warning" in result.output`
- `tests/unit/adapters/test_cli_scan.py:715` — `result.output.count("warning: run log") == 1`
- `tests/unit/adapters/test_cli_validate.py:176` — `"warning" in result.output`
- `tests/unit/adapters/test_cli_validate.py:163` — `"warning" not in result.output`

The `test_cli_scan.py:715` case is the ADR-0011 decision 2 run-log
failure line, the one warning the ADR names explicitly.

## Evidence

Measured 2026-08-16 on `click` 8.4.2:

```
output contains stderr line: True
stdout contains stderr line: False
stderr attribute: 'warning: to stderr\n'
```

`CliRunner` no longer takes `mix_stderr`, and `result.stderr` reads the
error stream alone. So a test can pin the channel today.

## Why it matters

ADR-0011 decision 1 keeps two channels apart. A warning that drifts to
stdout would corrupt a piped report and no test would fail. PR #290
added a fifth assertion of the same shape and then converted it to
`result.stderr`, which now fails when `err=True` is removed. The four
older ones do not.

## What closing looks like

Assert `result.stderr` at the four sites, and read command output from
`result.stdout`. PR #290 left them alone to stay scoped to #261.

Found while working #261 (PR #290), from a Copilot review comment whose
stated reason was different — it claimed version-dependence, which does
not hold on the pinned click.

Inspect the four named assertions in tests/unit/adapters/test_cli_scan.py and tests/unit/adapters/test_cli_validate.py, along with ADR-0011’s channel decisions. Check how the tests currently use result.output, then verify the intended streams with result.stdout and result.stderr. Done means the warning assertions pin stderr and report-output assertions use stdout; run the affected CLI tests.

Written by the indexing model from the issue text.