fix(redteam): derive attack successful from threat field

[cdot65]

Summary

• airs redteam report <jobId> --attacks printed BLOCKED for every attack regardless of outcome.
• Root cause: listAttacks normalizer at src/airs/redteam.ts:467 lifted a.successful — a field the API doesn't return per airs --debug capture. Result was always undefined (falsy) → renderer always picked BLOCKED.
• Fix: derive successful from a.threat in the normalizer. Renderer logic unchanged (was already correct given a correct successful value).
• Updated existing listAttacks test mocks to reflect real API shape (threat instead of stale successful).

Test plan

• RED: existing listAttacks test now fails (mocks switched to threat); new test confirms missing threat → successful: false; renderer regression tests for BYPASSED/BLOCKED
• GREEN: 685/685 tests pass
• pnpm lint clean
• pnpm tsc --noEmit clean
• pnpm test 685 passed
• pnpm docs:check clean

Closes #205