docs: record why an all-negligible image is not rendered as clean

The previous wording called the 0 0 0 0 strip a visible consequence worth
closing and named a route to close it, which invites exactly the change it
should prevent.

Clean is not the same as nothing worth reporting. A clean image has no
findings; an image whose findings are all Negligible or Unknown has findings,
none of which rise to a flagged severity, and the vulnerabilities tab lists
what the strip does not. Rendering it as clean would assert something untrue.
The headline exceeding the four counts is the same distinction: the total is
how many were found, the boxes are how many merit action.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U1Km3N3uUmeGaj7VbaM8PF

SCANNER_BUGS.md

@@ -81,14 +81,21 @@ worth flagging in most cases. The four boxes are a deliberate summary of what
 merits attention, not an exhaustive partition of the total, and the detail table
 already lists every finding including the unbucketed ones.
 
-Two narrow consequences remain visible and are recorded so the next reader does
-not mistake them for oversights: the headline "N vulnerabilities" beside the
-four boxes is a larger number than they sum to on multi-severity distros, and an
-image whose findings are *entirely* Negligible or Unknown has `Total > 0`, so it
-skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`. If
-either is ever worth addressing, the cheap route is to derive the headline from
-the four counts rather than adding a fifth bucket, which needs no lexicon or
-protocol change.
+Two consequences follow, and both are intended. Recorded here because each
+looks like a rendering bug from the code alone, and the next reader should not
+"correct" them.
+
+The headline "N vulnerabilities" beside the four boxes is a larger number than
+they sum to on multi-severity distros. That is the point: the total is the
+finding count, the boxes are the ones worth acting on.
+
+An image whose findings are *entirely* Negligible or Unknown has `Total > 0`,
+so it skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`.
+This is correct, because **"clean" is not the same as "nothing worth
+reporting"**. A clean image has no findings at all; this one has findings, none
+of which rise to a flagged severity. Rendering it as Clean would assert
+something untrue, and the vulnerabilities tab lists exactly what the strip does
+not.
 
 **The 512 MiB `GOMEMLIMIT` does not scale with `scanner.workers`.** Process-wide
 rather than per-worker, so it is divided among concurrent scans: +1.7% for a