fix: review pass 2 (delta): usage text, pass-marker capture group, GitHub-host origin parsing, idempotent trend.csv

- usage() strips the header comment decoration again; --help text asserted
- passCount takes the first all-digit capture group; --pass-marker without a capture group exits 2
- --repo falls back to the origin remote only on github.com or GH_HOST; a local-path origin exits 2
- trend.csv keeps one row set per repo and window (a rerun replaces its rows) and always carries its header
- /retro Step 7.5 points at SCORECARD_TREND for the weeks; the doc cites the per-PR baseline CSV

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

lib/factory-scorecard.ts

@@ -167,8 +167,10 @@ export function readMergedPrs(source: ScorecardSource, o: ScorecardOptions, sinc
 export function passCount(text: string, marker: RegExp): number | null {
   let max: number | null = null;
   for (const m of text.matchAll(new RegExp(marker.source, marker.flags.includes('g') ? marker.flags : marker.flags + 'g'))) {
-    const n = Number(m.slice(1).find(g => g !== undefined));
-    if (Number.isFinite(n) && (max === null || n > max)) max = n;
+    const digits = m.slice(1).find(g => g !== undefined && /^\d+$/.test(g));
+    if (digits === undefined) continue;
+    const n = Number(digits);
+    if (max === null || n > max) max = n;
   }
   return max;
 }