Normalize Slack issue severity, and stage the SDK v3.6.0 bump

[lelia]

🚨 NOTE: NOT READY TO MERGE UNTIL SocketDev/socket-sdk-python#107 SHIPS

Summary

Every severity lookup in the Slack reachability formatter is keyed on medium, but middle is what the API sends — it is the value in the OpenAPI spec's SocketIssueSeverity and in the SDK enum. A mid-severity finding therefore missed all of them at once:

• Not counted. severity_counts has no middle key and the increment is guarded by if ... in severity_counts, so the summary always read Medium: 0.
• Excluded from total_findings. Since omitted_count = total_findings - len(selected_vulnerabilities), a batch of mid-severity findings can drive the "and N more" line negative.
• Sorted below low. SEVERITY_ORDER.get(severity, 4) returned the default of 4 against low's 3, so mid-severity findings sank to the bottom and were the first truncated at the block limit.
• Wrong emoji, which is the least of it.

The findings themselves were always listed — purl_groups drives that, not the counts — so this is a wrong summary and wrong ordering rather than a missing finding or a false all-clear.

Fixed by normalizing to one spelling where the alert is read, rather than adding a parallel middle key to four dicts. Messages.map_socket_severity_to_gitlab and the GitLab severity map already accept both forms with a comment calling middle the older format; this formatter never got the same treatment. Worth noting the live spec still lists middle, so it is the current value rather than a legacy one.

Seven regression tests; five of them fail without the one-line change.

Blocked: the socketdev 3.6.0 bump

Waiting on SocketDev/socket-sdk-python#107 to merge and 3.6.0 to publish. Since the pin is exact, socketdev==3.6.0 cannot land here until the package is actually on PyPI.

• socket-sdk-python#107 merged
• 3.6.0 published to PyPI
• bump socketdev==3.5.0 → ==3.6.0 in pyproject.toml, re-run uv lock
• add the changelog entry, mark ready for review

That bump needs no other CLI change. Verified by installing the 3.6.0 branch and running this suite: 392 passed, 2 skipped, no failures. The CLI imports none of the SDK's enum types, and every severity lookup already has a default, so the new fallback members cannot reach an unguarded branch. The gain is that ten purl types — vscode, chrome, edge-extension, firefox-extension and others — stop being reported as unknown.

---

Note

Low Risk
Small, localized formatter change with regression tests; no auth, API, or scan-blocking behavior.

Overview
Release 2.6.13 fixes how mid-severity alerts appear in Slack reachability notifications when the API sends severity as middle (OpenAPI/SDK spelling) while the Slack formatter only keyed lookups on medium.

In _extract_alert_info, middle is now mapped to medium at read time (same idea as Messages.map_socket_severity_to_gitlab), so Medium counts, total_findings, sort order, emoji, and block-limit truncation behave correctly instead of treating mid findings as unknown/low-priority. Findings were still listed; the bug was summary math and ordering.

Adds unit tests in test_slack_severity_normalization.py and updates the changelog and package version (2.6.12 → 2.6.13).

^{Reviewed by Cursor Bugbot for commit 794ce00. Configure here.}