fix(redteam): render attack subcategory display name in report

[cdot65]

Summary

• airs redteam report <jobId> --attacks was printing undefined for every attack's subcategory because the renderer read a.name (lifted from a no-longer-returned attack_name field).
• Normalizer at src/airs/redteam.ts:454 now lifts sub_category_display_name into the subCategoryDisplayName field on RedTeamAttack.
• Renderer at src/cli/renderer/redteam.ts:203 now prints subCategoryDisplayName ?? subCategory ?? '—' — readable display name preferred, raw value fallback, em-dash if neither.
• Unknown rows render — instead of literal undefined.

Test plan

• RED: 5 new tests across normalizer (tests/unit/airs/redteam.spec.ts: lifts display name, undefined when omitted) and renderer (tests/unit/cli/redteam-attacks-renderer.spec.ts: display-name, raw fallback, em-dash) — all failed before implementation
• GREEN: 682/682 tests pass
• pnpm lint clean
• pnpm tsc --noEmit clean
• pnpm test 682 passed
• pnpm docs:check clean

Closes #204