Let the caller state the project's version

--version replaces the commit hash on the cover and the project page, for
generate and from-folder alike. Without it the report still falls back to
repository_version from the metadata, else the scanned commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -23,7 +23,7 @@ Two ways to say where the artifacts are.
 
 ```
 report_generator generate --scan_id <uuid> [--path <file-or-directory>] --config config.json
-    [--project <name>] [--manufacturer <name>]
+    [--project <name>] [--manufacturer <name>] [--version <version>]
 ```
 
 **Out of a folder** — neither Postgres nor the bucket, just the artifacts as the pipeline exported
@@ -31,9 +31,12 @@ them:
 
 ```
 report_generator from-folder --artifacts ./sample [--path <file-or-directory>]
-    [--project <name>] [--manufacturer <name>]
+    [--project <name>] [--manufacturer <name>] [--version <version>]
 ```
 
+`--version` sets the version shown on the cover and the project page. Without it the report uses
+`repository_version` from `metadata.json`, else the commit the scan was run on.
+
 `--scan_id` is optional there: the pipeline writes its own id into the paths it records in
 `metadata.json`, so an export names its own run. Pass it for a folder assembled by hand, or one
 whose metadata is gone.