fix(arborist): fix audit-report determinism due to dropped via links (#9603)

**Description:**
Fixes #8989

**Bug:**
`npm audit` was occasionally generating non-deterministic output with
missing vulnerabilities when metavulns from identical-range dependencies
caused a collision.

**Root Cause:**
In `AuditReport#init`, the deduplication logic (`if (!seen.has(k))`) was
aggressively dropping identically-computed metavuln advisory ranges
across different dependency paths. Because `vuln.addVia()` was invoked
*inside* this block, a duplicated range collision would simply skip the
execution and permanently drop the `via` link (and its corresponding
`effects` link). Consequently, depending on the random `Promise.all`
resolution order of the metavuln calculator across network calls,
different `via` branches were being non-deterministically truncated.

**Fix:**
This PR extracts the `addVia` operation from the `seen` deduplication
block and implements a comprehensive post-loop reconciliation pass. We
ensure that:
1. `via` and `effects` links are deterministically established *after*
all dependencies and metavulns are cleanly instantiated.
2. The reconciliation ignores already deleted advisories, guaranteeing
that the cleanup lifecycle (`deleteAdvisory`) cannot be accidentally
resurrected.
3. Because we aren't repeatedly calling the `fixAvailable` setter during
the primary loop iterations, performance overhead remains minimized.

**Testing:**
- Added a new strict programmatic determinism test in `audit-report.js`
covering the identical range metavuln fallback (`*`) condition.
- Confirmed the new test correctly reproduces the regression (fails
deterministically on unfixed code by dropping the `via` path).
- All 27 existing suite tests pass flawlessly.