feat(output): add opt-in risk assessment

[limaronaldo]

Summary

• add scan --experimental-risk for console and JSON
• compute one agentshield-risk-v1 assessment from the final post-policy/post-baseline findings
• keep PASS/FAIL primary and label the index informational
• expose model and coverage identities plus bounded, source-safe contributions
• reject SARIF, HTML and --explain combinations explicitly

Compatibility and policy

Default console, JSON, SARIF, HTML and DSSE output is unchanged. The flag does not change findings, policy thresholds, verdicts, exit status, fingerprints, baselines or suppressions. The public addition is one renderer function returning a string; internal assessment types remain private.

Safety

At most 50 ordered contributions are emitted, with an explicit omitted count. Contributions contain only fingerprint, rule id, effective severity, confidence and points. No source, snippets, evidence or environment data is copied.

Review

Code review found no blockers. Two evidence gaps were fixed before publication: a real 50-contribution truncation test and a console ordering/label test.

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-targets --locked — 419 passed
• cargo test --no-default-features --locked — 385 passed
• supported python, typescript, runtime and runtime-guard feature checks
• real console and JSON smoke runs
• git diff --check

[limaronaldo]

Code review verdict: PASS — no unresolved findings.

Checklist:

• opt-in only; default render path is unchanged
• score consumes final report findings after policy and optional CLI baseline filtering
• verdict and process exit status remain authoritative
• console keeps PASS/FAIL before the informational section
• JSON adds data only under explicit opt-in
• SARIF, HTML, explain and DSSE are not modified
• assessment is computed once per render
• model and coverage identities accompany the score
• contributions are deterministic, source-safe and capped at 50
• unsupported combinations fail as invocation errors
• public API change is additive and internal types stay private
• default/no-default and supported feature configurations pass