feat(workload): print the compliance score on successful scans, not only in threshold failures

> 🤖 Generated by the Daily AI Engineer

## Problem

`ksail workload scan --compliance-threshold ` prints the measured compliance score **only when the gate fails** (`security scan failed: compliance score 94.99% is below threshold 100.00%`). On a passing run the score is not printed at all — neither in the summary tables nor as a closing line.

This makes threshold *ratcheting* needlessly awkward in CI: the score is environment-dependent (documented in devantler-tech/platform AGENTS.md — the same binary/manifests score differently on Linux runners vs macOS), so operators must learn the CI-side score to place the floor. Today the only way is to push a deliberate threshold-100 failing run and read the error (exactly what platform#2584 had to do). It also hides gradual posture drift: a repo can decay from 99% to 86% with a floor of 85 and no run output ever shows it.

## Proposed direction

Always print one line with the per-framework (or aggregate) compliance score at the end of the scan — on success and failure alike, e.g. `✔ compliance score 98.87% (threshold 85.00%)`. No new flag needed; it is a pure output addition. Cover both states in tests (with/without `--compliance-threshold`).

## Rough size

S.

Start at the workload scan command and trace the existing compliance-threshold failure output. Add coverage for both successful and failing scans, with and without --compliance-threshold, and verify that each scan ends with the per-framework or aggregate compliance score.

Written by the indexing model from the issue text.