summary.unwrap() relies on a filter performed in another function

[vyncint]

launchbound-tui and launchbound-report unwrap candidate.summary on the strength of a filter performed elsewhere: app.rs:257–317 ("filtered on Some", plus two bare unwrap()), report/build.rs:140 ("chosen is measured"). Each is true today; each is an invariant that lives in a different function from the code that relies on it, and a refactor of the filter breaks the unwrap silently.

Fix. Carry the guarantee in the type: a Measured newtype (or filter_map into a Vec<(Candidate, &Summary)>) at the filter site, so the consumer never holds an Option. Same treatment for build/cache.rs:48,62 and bench/run.rs:292,429 where a Result is the honest type.

Done when

• No unwrap/expect on summary outside test modules; the compiler enforces the invariant.