#3762 @swamp/cve/dirtyfrag report suggests commands for dirtyfrag-scanner whatever the model is named

The scan and mitigate report in @swamp/cve/dirtyfrag (extensions/reports/dirtyfrag_scan_report.ts, 2026.10.22.1) hardcodes the model name dirtyfrag-scanner in every follow-up command it prints (To apply, Verify with, Next Step). Since the README now has users create one model per target with --global-arg (dirtyfrag-web, dirtyfrag-fleet, dirtyfrag-container), copying the suggested command runs against the wrong model, or one that does not exist, and so with the wrong SSH user and key. The Next Step block also builds --input hosts from each result's hostname (e.g. ip-172-31-35-99, the remote host's own name) rather than the address it was scanned at, so on a fleet scanned by IP the suggested hosts list may not resolve. Expected: use the running model's name and the scanned address. Found while triaging swamp-club #3761.