Previously this arithmetic lived entirely inside the renderer as closure
locals that only ever became interpolated Markdown text -- no exported
type backed any of it, so nothing downstream (the --json envelope, a CI
gate, a future Finding Model adapter) could consume it as data. Extracted
so it can be reused wherever these facts are needed, not just prose.
Computes every number
renderSecurityReview()reports, as real data.