Never present a failed or undecided check as a clean result

[pepo72]

Summary

The README says a failed check never counts as clean. A few paths still presented a failed or undecided check as a clean result:

• pyHanko's reader.embedded_signatures raises on the first signature whose CMS container cannot be read. The error only went into the facts, the analysis stayed complete, and the only finding was a LOW note that blamed a legacy format. One damaged signature also left every other signature in the file unvalidated.
• When pdfsig could not verify a signature, no finding was produced.
• signature.validation-error had LOW confidence, so it counted as LOW.
• When an analyser failed, the summary still listed its area under "Checked and found in order", and the batch table showed the verdict with no marker and counted the file as "without significant findings".

Changes

• signatures.py: signatures are loaded one by one, with the same SubFilter filter pyHanko uses. A CMS container that cannot be read is signature.unparseable (HIGH); other loader failures are signature.validation-error, now with MEDIUM confidence. A pyHanko failure while reading the file marks the analysis incomplete. Document timestamps are validated with validate_pdf_timestamp. Files with only an owner password are decrypted before reading.
• pdfsig.py: new pdfsig.integrity-unknown (MEDIUM, low confidence) when Poppler did not verify a signature and pyHanko did not settle its integrity either. Empty signature fields are skipped.
• summary.py: "Checked and found in order" lines are only written for analysers that ran without error, for PDF and Office. The signature line is withheld when any signature finding leaves integrity in doubt. The batch summary counts incomplete files separately and lists them in the JSON.
• render.py: the batch table marks incomplete verdicts.
• cli.py: new opt-in --fail-on-incomplete exits 1 when an analysis is incomplete or a file could not be analysed. --fail-on is unchanged. Legacy .doc/.xls/.ppt files are always incomplete, which is why this is a separate flag and noted in the README.

Testing

• pytest: all tests pass, including new tests for a damaged signature among valid ones, document timestamps with and without a prior signature, an empty signature field, an owner-password-only signed file, analyser failures in the summary and batch output, and both exit-code flags.
• Checked with pdfsig enabled on genuine files: single and double signatures, certification and certification plus approval, signature timestamps, document timestamps, an empty signature field, and owner-password encryption. Each gives the same or a lower verdict than before; document timestamps and the encrypted file go from low to info. Damaged signature containers go from low to high.
• The bank-statement examples give identical results before and after.

This touches summary.py and tests/pdfgen.py next to #3; whichever is merged second may need a small rebase, which I can do.