Do not mark threats without controls as verified in Pentest Preparation

## Summary

Pentest Preparation labels threats with no countermeasures as **Verified** instead of identifying them as exposed or requiring attention.

## Steps to reproduce

1. Open an authenticated threat model.
2. Add a component to the DFD.
3. Add a library threat to that component.
4. Leave the threat with no countermeasures.
5. Save the threat model.
6. Open the **Pentests** tab.
7. Expand **Test Cases by Component** and find the threat.

## Actual behavior

The threat is shown with a **Verified** defense status even though the expanded details say that no countermeasures are defined. It is also not counted as a countermeasure gap in the summary metrics.

## Expected behavior

A threat with no countermeasures should be clearly classified as exposed or unprotected and included in the relevant pentest-priority and gap metrics.

## Evidence

The pentest transformer defaults an empty countermeasure list to `verified`:

https://github.com/precogly/precogly/blob/cb37379df2bfa9b43b02327e006b4cb6f92e035f/frontend/src/features/pentests/utils/scopeTransformers.ts

https://github.com/user-attachments/assets/ed095344-b21e-4781-9ee4-fb827e65f067

Start with frontend/src/features/pentests/utils/scopeTransformers.ts and trace how a threat with an empty countermeasure list is classified for the Pentests tab. Reproduce the listed steps, then verify that the threat is no longer shown as Verified and is included in the relevant priority and countermeasure-gap metrics.

Written by the indexing model from the issue text.