security watch: the RUNTIME line names the zstd decoder in words, not the module repr (R-1327)

scripts/CHANGELOG.md

@@ -7,6 +7,8 @@
   error while a layer decodes is a NOTE, never a pass.
 - **`security_watch.py`:** a `RUNTIME read=N (S s) from-cache=M not-checked=K zstd-decoder=…` line and one
   `RUNTIME-READ <image> <s> ok|NOT CHECKED` line per image read tonight.
+  The decoder is named in words (`zstd_decoder_how()`: „zstandard 0.25.0 (pinned wheel)" / „the zstd program" / none);
+  the first CI run printed the module's repr.
 - Tests: `test_image_runtime.py` 22 checks (zstd above gzip with no `zstd` program, a damaged and a cut-off zstd layer,
   no decoder, the wheel loader's hash refusals) — the zstd read seen failing on the 2026-10-27 module first;
   `test_security_watch.py` W10 counts (59 checks).