[codey] Use readable surface names in findings

[Conalh]

Summary

• replaces raw internal surface ids in user-facing MCP finding messages with readable names like Root MCP, Cursor MCP, and VS Code MCP
• updates GitHub annotation coverage so missing-server annotations assert the readable message text
• rebuilds the committed Action bundle and bumps release metadata to v0.1.17

Why

PolicyMesh already renders readable surface names in the matrix and Surfaces: summary, but several finding messages still exposed internal ids like root_mcp and cursor_mcp. Those messages appear in PR annotations, so this tightens the free Action's PR-review credibility.

Verification

• node --test test/cli-output.test.mjs (red before message formatting change, green after)
• npm run build
• git diff --exit-code -- dist
• npm test (37/37)
• node dist/index.js audit --repo . --format json (rating none, 0 findings)
• node dist/index.js audit --repo test/fixtures/conflicted --format github
• git diff --check