fix(comments): keep the diff badge where artwork exists

Labelling every dependency overview row with bold text dropped the badge from
added rows, which is the only category the overview rendered before. The badge
host publishes diff-added.svg and diff-updated.svg but nothing for removed or
replaced, so look the badge up per change type and fall back to the text label
only where there is no image to render.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

socketsecurity/core/messages.py

@@ -1247,6 +1247,23 @@ def create_remove_line(diff: Diff, md: MdUtils) -> MdUtils:
         md.new_line(removed_line)
         return md
 
+    # Change types the shared badge host publishes an image for. Removed and
+    # replaced have no artwork, so they fall back to a bold text label rather than
+    # rendering a broken image; added and updated keep the badge the overview
+    # comment has always used.
+    DIFF_BADGES = {
+        "Added": "diff-added.svg",
+        "Updated": "diff-updated.svg",
+    }
+
+    @staticmethod
+    def get_diff_badge(change: str, package_url: str) -> str:
+        """Return the Dependency Overview cell marking how a package changed."""
+        badge = Messages.DIFF_BADGES.get(change)
+        if not badge:
+            return f"**{change}**"
+        return f"[![{change}](https://github-app-statics.socket.dev/{badge})]({package_url})"
+
     @staticmethod
     def create_added_table(diff: Diff, md: MdUtils) -> MdUtils:
         """
@@ -1279,7 +1296,7 @@ def create_added_table(diff: Diff, md: MdUtils) -> MdUtils:
                 package: Purl
 
                 package_url = f"[{package.purl}]({package.url})"
-                diff_badge = f"**{change}**"
+                diff_badge = Messages.get_diff_badge(change, package.url)
 
                 # Scores dynamically converted to badge URLs and linked
                 def score_to_badge(score):

tests/unit/test_dependency_overview.py

@@ -81,5 +81,10 @@ def test_dependency_overview_labels_each_change_type(tmp_path, monkeypatch):
 
     comment = Messages.dependency_overview_template(diff)
 
-    for change in ("Added", "Updated", "Removed", "Replaced"):
+    # The badge host publishes artwork for added and updated only, so the other
+    # two fall back to a text label rather than a broken image.
+    assert "diff-added.svg" in comment
+    assert "diff-updated.svg" in comment
+    for change in ("Removed", "Replaced"):
         assert f"**{change}**" in comment
+        assert f"diff-{change.lower()}.svg" not in comment