feat(cli): add --quiet flag to suppress info-level stderr diagnostics

[not-knope]

Closes #48

What changed

• Added --quiet to bumblebee scan to suppress info-level diagnostics on stderr.
• Extended output.Emitter with a quiet mode (SetQuiet) so Diag("info", ...) is counted but not written when quiet is enabled.
• Warn and error diagnostics still emit on stderr with --quiet.
• NDJSON record output, scan_summary, exit codes, and default (non-quiet) behavior are unchanged.
• Added unit tests in internal/output/output_test.go and documented the flag in README.md.

Why

Scheduled CI/cron scans that pipe NDJSON to a downstream sink currently emit noisy info diagnostics on every successful run (resolved-root notes and the final scan complete: line). Operators want stderr only when something is actually wrong. See #48.

How I tested it

go build ./...
go vet ./...
go test ./internal/output/... -run TestDiag -v
go run ./cmd/bumblebee selftest

All of the above passed on Windows (Go 1.25).

Note: go test ./... -race requires CGO on this host and was not run here. Full go test ./... on Windows hits pre-existing platform-specific failures in root-resolution tests (Unix path assumptions); unrelated to this change.

Out of scope / limitations

• No -q short alias: the stdlib flag package registers --quiet only (same as the reference PR feat(cli): add --quiet flag to suppress info-level stderr diagnostics #53).
• No changes to selftest --quiet (already exists separately).

Note

This PR was developed with AI assistance (Cursor), as reflected in the
commit's Co-authored-by trailer. All code was reviewed, tested, and
verified locally before submission — the design decision to centralize
the quiet logic in Emitter.Diag() and the final verification steps
(build, vet, tests, selftest) were done manually.