Let the project name and the manufacturer be supplied on the command line

Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

report_generator/rendering.py

@@ -46,11 +46,20 @@ REQUIRED_ANY = ("findings", "vulnerabilities")
 NAME = "report_{scan}.pdf"
 
 
-def render(sources: ReportSources, metrics: dict[str, Any] | None = None) -> tuple[str, bytes]:
+def render(
+    sources: ReportSources,
+    metrics: dict[str, Any] | None = None,
+    *,
+    project: str | None = None,
+    manufacturer: str | None = None,
+) -> tuple[str, bytes]:
     """Render the report of one scan.
 
     Args:
         sources: What :func:`sources.collect` found.
+        metrics: The metrics document, if one was built.
+        project: The project name the caller supplied; overrides the metadata's.
+        manufacturer: The manufacturer the caller supplied.
 
     Returns:
         The file name the report should be saved under, and its bytes.
@@ -72,7 +81,9 @@ def render(sources: ReportSources, metrics: dict[str, Any] | None = None) -> tup
 
     logging_context.logger.info(f"Rendering the report from {', '.join(found)}...")
 
-    return NAME.format(scan=sources.scan_id), render_pdf(build_context(sources, documents))
+    context = build_context(sources, documents, project=project, manufacturer=manufacturer)
+
+    return NAME.format(scan=sources.scan_id), render_pdf(context)
 
 
 def _parsed(sources: ReportSources, name: str, candidates: tuple[str, ...]) -> Any | None:  # noqa: ANN401