Strengthened vulnerability reporting guidance

Updated documentation and tool guidance to clarify severity assessment for subdomain takeovers, enforce proper vulnerability reporting workflows (including dependency CVE reporting), and require attack-chain analysis before finalizing scan reports. Added warnings that finish_scan is a terminal action with no draft mode, and emphasized the importance of using the correct reporting tools (create_vulnerability_report or create_dependency_report) before marking findings as complete.