[Bug] Unparseable lockfile shows a corporate SSL proxy hint and doesn't name the file

Summary

If the lockfile (or package.json in manifest fallback) can't be parsed, the scan fails with the raw parser error and then suggests setting up a corporate CA certificate. Two problems with that:

• the error doesn't say which file failed, so in a monorepo you have to guess
• the SSL proxy hint is wrong. It shows up even with --offline, where no network request is made at all

Environment

• OS: macOS 26.3
• Node.js version: v26.7.0
• Package manager: npm (also reproduced with pnpm)
• Lockfile type: package-lock.json, pnpm-lock.yaml, package.json fallback
• CVE Lite CLI version: 1.34.0 (main)

Command used

mkdir broken && cd broken
echo '{"name":"x"}' > package.json
echo '{' > package-lock.json
cve-lite . --offline

Expected behavior

The error names the file that couldn't be parsed, and there's no network hint for a local parse failure.

Actual behavior

Error: Expected property name or '}' in JSON at position 2 (line 2 column 1)
Hint: If your network uses a corporate SSL proxy, a CA certificate may be required.
Run: cve-lite config set ca-cert /path/to/corporate-ca.crt

Same thing with an empty package-lock.json, an invalid pnpm-lock.yaml, or an invalid package.json with no lockfile.

Relevant files or output

• The top-level catch in src/index.ts passes every error to getNetworkErrorHint(), and its last line in src/utils/network.ts returns fetchErrorCaCertHint() for anything it doesn't recognise. tests/network.test.ts currently expects that for "unrelated errors" too.
• The parsers call JSON.parse / the YAML parser directly, so the file path never makes it into the message.

Suggested fix: wrap lockfile/manifest loading in loadPackages so the error includes the path, and only fall back to the CA hint when the error actually came from a request (OSV errors or fetch failed). I have this working locally with tests and can open a PR.

Start with the top-level catch in src/index.ts, getNetworkErrorHint() in src/utils/network.ts, and package loading through loadPackages. Review tests/network.test.ts and the parser call sites; done means parse failures identify the lockfile or manifest and the CA hint is limited to request-related errors, with tests covering these cases.