fix(compare): clarify filtered output path semantics

[mstykow]

Summary

• rename compare path-only buckets so they describe final output membership instead of implying scan coverage gaps
• add comparison_context metadata and filter-aware notes when --only-findings is active, including direct-JSON detection from header options
• cover the new wording with compare tests and document the semantics in xtask/README.md

Scope and exclusions

• Included: shared compare library changes, xtask compare-output changes, compare tests, and xtask docs
• Explicit exclusions: no scanner behavior changes and no new true coverage-only buckets

Intentional differences from Python

• No scanner-output behavior change is intended. This only makes Provenant's compare artifacts more explicit about filtered-output semantics under --only-findings.

Follow-up work

• Created or intentionally deferred:
  • Deferred separate "not scanned" coverage buckets until compare-outputs has reliable scan-coverage data distinct from final filtered JSON membership.

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: compare artifacts now reflect post-filter path membership accurately, so paths hidden by --only-findings are no longer mislabeled as scanner-only coverage differences.