feat(import): --accept writes the products a person confirmed

[maksimtech]

Audit finding PR-01, step 01c-1 (docs/DESIGN.md §5.6). Stacked on #62; the order is #59 → #60 → #61 → #62 → this one.

What was wrong

import proposes and a person confirms, and what gets remembered is the confirmation (inventory.py). Until the watchlist had the columns, the confirmation had nowhere to go: the command wrote nothing and ended by saying "a confirmed mapping needs the watchlist columns … which this release does not have".

What changes

• patchradar import <file> --accept "<name>", repeatable, once per product. The name can be that of any registry entry in the product's family.
  • A product the survey identified completely (today Chrome and Edge) is put on the watchlist with the registry's version and its vendor source in vendor/product_id (set_source, from fix(watchlist): vendor and product_id are the vendor source's, as inventory.py meant #62).
  • Anything else is refused with the survey's own reason, and the command exits 1. That covers a source without the product it needs (MSRC for Office, which lists 13 products per advisory), a component, and a program no source answers for. Whatever was confirmed alongside is still written.
• Without --accept nothing is written, and the closing line says how to accept.
• channel stays empty: the two certain sources today are matched without it (DESIGN §5.6 says so).
• Docs: README, docs/nis2-compliance.md (import writes to the local watchlist only on --accept) and DESIGN §5.6 updated.

Tests (strict TDD)

• tests/test_import_accept.py, 11 tests in the style of test_cli_import.py, with snapshots built in the collector's shape:
  • write with version and source; matching ignores case; only what was accepted is written; nothing without --accept;
  • the three refusals; a name not in the inventory; a refusal does not cancel what was confirmed;
  • no version; accepting again updates; naming a product by one of its other registry entries.
• Seen failing first (10/10 red).
• Mutants killed: each refusal, the version write, the exit code, the lookup by any entry.
• A branch that was unreachable (a certain name the watchlist would refuse; the certain rules match exact clean names) was removed rather than left untested.
• Full suite: 2228 passed; ruff and mypy clean.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[maksimtech]

Folded into #64, which now targets main with every commit of the stack: one review, one merge, no conflicts from squash merges.