chore: fix TypeScript code quality violations from May 2026 audit

Small, self-contained refactors from a code-quality audit. Each bullet below is its own task and its own PR - please do not try to do them all in one. Comment on the issue saying which one you are taking so others can see, though the first working PR is the one that lands.

Re-verified against main on 2026-09-16, so the counts and paths below are current.

1. Extract the CLI flag literals in src/cli/args.ts

39 distinct flag strings ("--json", "--all", "--offline" and so on) appear as inline literals, 55 occurrences in total. Extract them into named constants so a typo becomes a compile error rather than a silently unrecognised flag. src/constants.ts already holds this kind of thing (DEFAULT_BATCH_SIZE, CACHE_TTL_MS) and is a reasonable home, or a dedicated src/cli/flags.ts if that reads better.

Good first issue. Mechanical, but please keep the flag spellings byte-identical - the tests and the docs both depend on them.

2. Extract the install command in src/utils/update-check.ts

src/utils/update-check.ts:98 has npm install -g cve-lite-cli inline. The registry URL right above it is already a named constant (NPM_REGISTRY_URL), so this is following an established pattern in the same file.

Good first issue, genuinely a few lines.

3. De-duplicate the flag-conflict errors in src/cli/validate.ts

Seven near-identical --X cannot be used with --Y messages. Extract a helper that takes the two flag names and builds the message, so the wording stays consistent when the eighth one is added.

4. Add braces to the remaining single-line if statements

Eight in src/cli/args.ts and one in src/index.ts:131. For example src/cli/args.ts:74:

if (!val) throw new Error("--ca-cert requires a path argument");

Note this was previously filed as #1089 and closed as not-planned, so it is genuinely still open. There is no linter enforcing it yet; adding ESLint with curly is tracked separately as #1091, and that will supersede this task if it lands first.

Not in scope

scanPackages in src/scanner.ts is 1122 lines and well past our 60-line guideline, but it is core scanner internals and is being handled in-house. Please do not refactor it as part of this issue.

Already fixed, please do not re-report

The original May 2026 audit listed several items that have since been resolved. Leaving them here so nobody spends time re-finding them:

• Nested ternary in src/output/formatters.ts - now an else-if chain
• batchSize / searchDepth - now DEFAULT_BATCH_SIZE / DEFAULT_SEARCH_DEPTH in src/constants.ts
• Cache TTL - now CACHE_TTL_MS
• The npm registry URL - now NPM_REGISTRY_URL
• The src/index.ts line references from the old audit are stale; that file was reduced from 973 lines to 191 in #1129, and the advisory-DB warnings it mentioned now live in src/scan/single-scan.ts

Before you open a PR

Run npm test and npm run build. Keep each PR to one bullet above.

Choose one bullet and comment on the issue before starting. Read the named file and nearby existing constants or messages, preserve the stated spellings and scope, then run npm test and npm run build; done means the selected refactor is complete without combining bullets.