[Bug] --no-cache does not bypass the npm advisory cache

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

--no-cache does not disable all caching. options.noCache is honoured for OSV queries (src/scanner.ts:174) and in the npm registry publish-date paths (scanner.ts:584, :745, :883), but it is never checked anywhere in the npm advisory block at scanner.ts:253-300. That block reads cache.npmAdvisoryEntries and writes back to it regardless of the flag.

Measured on bennycode/trading-signals against main at the time of filing, two consecutive --no-cache runs:

run 1:  7 packages · 18 CVEs
run 2:  7 packages ·  9 CVEs   + Partial scan warning

A flag whose whole purpose is to take the cache out of the picture should not leave a run depending on cache state. This is how #1165 stayed hidden: --no-cache was used to get a trustworthy reading and quietly gave a cached one, which sent the investigation down the wrong path for a while.

Scope

Honour noCache in the npm advisory block the way the OSV query path does: skip the read, and decide deliberately whether to still write. There is an existing test asserting the scanner "still writes results to cache after a --no-cache scan", so the write side is intentional for the other caches and the same choice should be made explicitly here rather than by omission.

Worth checking the other cache sections in the same pass for the same gap.

Found while fixing #1165.

This is explicitly an in-house tracking item already being handled by the maintainer, so it is not open for contribution. For internal follow-up, inspect the npm advisory block in src/scanner.ts:253-300, compare its noCache handling with the OSV path at src/scanner.ts:174, and review the existing test that checks cache writes after a --no-cache scan.