fix: surface CPU thermal throttling in status and SAT results

A CPU that had thermally throttled (sysfs thermal_throttle counter >
0) still reported status "OK" everywhere: dmidecode-derived CPU status
only distinguishes populated/enabled/disabled and never looked at the
throttle flag the collector already recorded next to it, and neither
SAT path meant to catch this actually could:

- The routine "cpu" SAT pack (RunCPUAcceptancePack) only checked
  lscpu/sensors/stress-ng exit codes — stress-ng exits 0 whether or
  not the CPU throttled while running it, so an 89°C/throttled CPU
  right after a "successful" run still showed cpu:all as OK in
  component-status.json.
- The more thorough platform-stress test already detected throttling
  and fan-spindown correctly, but wrote its verdict as "Overall: FAIL
  — ..." with no "=", which parseSATKV can't parse — so even a real
  detected throttle event never reached the component-status DB.

Fixes:
- cpu_telemetry.go: escalate a CPU's status to Warning (only-escalate,
  same severity ranking already used elsewhere) when Throttled is set.
- sat.go: add a before/after thermal-throttle-counter check job around
  the "cpu" pack's stress-ng run, so a throttle event during the run
  fails that job and (via the existing FAILED->Warning DB mapping)
  flips cpu:all to Warning.
- platform_stress.go: emit a machine-readable overall_status= line
  alongside the human-readable verdict so platform-stress results
  actually reach ApplySATResultToDB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/platform/platform_stress.go

@@ -331,12 +331,24 @@ func writePlatformSummary(opts PlatformStressOptions, analyses []cycleAnalysis)
 	}
 
 	fmt.Fprintf(&b, "%s\n", strings.Repeat("=", 48))
+	// overall_status is the machine-readable twin of the "Overall: ..." line
+	// below, in the key=value vocabulary ApplySATResultToDB/parseSATKV
+	// expects (OK/FAILED/PARTIAL/UNSUPPORTED). Without it, a throttle FAIL
+	// detected right here never reaches component-status.json: the DB writer
+	// only recognizes "overall_status=", and "Overall: FAIL — ..." has no
+	// "=" for parseSATKV to split on. FAILED is the only token that maps to
+	// DB status "Warning" (see satStatusToDBStatus), so both throttle and
+	// fan-spindown findings use it — there's no separate "WARN" token in the
+	// SAT summary vocabulary today.
 	if totalThrottle > 0 {
 		fmt.Fprintf(&b, "Overall: FAIL — throttle detected in %d/%d cycles\n", totalThrottle, len(analyses))
+		fmt.Fprintf(&b, "overall_status=FAILED\n")
 	} else if totalFanWarn > 0 {
 		fmt.Fprintf(&b, "Overall: WARN — fast fan spindown in %d/%d cycles (cooling recovery risk)\n", totalFanWarn, len(analyses))
+		fmt.Fprintf(&b, "overall_status=FAILED\n")
 	} else {
 		fmt.Fprintf(&b, "Overall: PASS\n")
+		fmt.Fprintf(&b, "overall_status=OK\n")
 	}
 	return b.String()
 }