#345 Add a markdown output mode to swamp report get

Problem

Today swamp report get <name> produces a hybrid output: markdown headings + plain-text summary lines + tables drawn with Unicode box-drawing characters and styled with ANSI color escapes. That output is great in a terminal but breaks the moment you try to:

• Save it to a .md file (the box-drawing tables don't render as tables in any markdown viewer — they appear as runs of │ and ─ glyphs).
• Paste it into a markdown editor (Zed, VS Code, Obsidian, GitHub issue body, PR description, Slack canvas, etc.) — same problem, plus the ANSI escapes leak through if tee'd to a file.
• Pipe through any markdown-aware tooling (mdformat, pandoc, etc.) — the renderers don't understand the box-drawing tables.

--json exists, but it forces every consumer to rebuild the descriptor's markdown layout (section headings, summary lines, tally formatting, per-CVE display verdicts like Dirty Frag's VULNERABLE roll-up) by hand. That's the same rendering work the descriptor already performs server-side.

Proposal

Add a flag to swamp report get that emits the same content as today's default, but using markdown-pipe tables and no ANSI escapes:

swamp report get @hivemq/kernel-cve-copy-fail \
  --workflow kernel-cve-audit-prod \
  --markdown > prod-copy-fail.md

(or --format markdown if you prefer a single format-selector flag that can later grow --format json|markdown|ansi|plain.)

Output requirements:

• All headings/sub-headings stay markdown-native (#, ##, ###).
• Tables emit as markdown pipe tables (| col | col | + | --- |).
• No ANSI escape sequences.
• Cell contents have | and newline characters escaped/collapsed so the pipe tables stay well-formed.
• Summary lines stay readable text (e.g. **10 total** · 7 MITIGATED · 3 UNKNOWN).

Bonus: a sibling --no-color for the default mode would let folks keep box-drawing tables but strip ANSI for tee workflows.

Alternatives considered

• Strip ANSI from current output (sed -E 's/\x1b\[[0-9;]*[A-Za-z]//g') — still leaves the unreadable box-drawing tables.
• Rebuild markdown from --json per consumer — duplicates rendering logic that already lives in the descriptor's report definition; the Dirty Frag descriptor specifically overrides displayVerdict and formatSummaryLine, which client-side rebuilds either miss or duplicate.
• Per-descriptor "markdown mode" — each report author shouldn't have to implement this; it should live in the renderer.

Context

Surfaced while delivering kernel-CVE audits to a security reviewer who wanted the report content in a markdown editor for annotation. The team rebuilt markdown from --json to make the tables readable; a built-in mode would remove that step for every consumer.