refactor: make source risk sorting explicit

[willsarg]

Summary

• replace the custom iterator-based sorting helper with an explicit local Vec::sort_by path
• keep the risky-file ordering logic self-contained in source_analysis.rs
• add a regression test for the existing count-then-path ranking semantics

Validation

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo build
• cargo test
• ./scripts/test-scanner.sh (current origin/main still segfaults in quick/scan; the same baseline failure remains here)

Closes #78