#3910 @swamp/cve/tailworm grade: unix serve targets the probe could not resolve are graded as ordinary sockets

Follow-up from the #3908 review (PR #561).

1. Medium. grade runs nothing on the host, so a unix serve target the probe could not resolve stays unresolved. This happens when the probe is not run as root, when the path holds JSON escapes (the probe greps raw JSON strings), or when there are more than 50 unix: strings. analyze then grades a symlink to tailscaled.sock as an ordinary unix forward rather than a critical localapi forward. scan does not have this gap, because its follow-up resolve command covers those paths. Fix: in grade, report each unresolved unix target in the status (a medium exposure or a recommendation to check where it points) rather than grading it as safe, and have the probe decode JSON escapes or let the parser match on decoded paths.

2. Low. parseProbe matches RESOLVE lines by the prefix path plus a pipe, and the last match wins. If the serve config holds both /a and a path that starts with /a and a pipe, /a is attributed the other path's result. The comment says this cannot happen. scanTarget's resolve loop has the same pattern. Prefer an exact or longest match.

3. Low. Probe output with CRLF line endings, such as from kubectl exec -t, is reported as cut off before its END line. Normalise CRLF in gradeOutput, or name the cause in the error.

It never yields a clean grade from bad output; the risk is a missed critical in item 1.