feat: add explainable path-specific policies

[Hayal08]

What changed?

• Add explainable risk score breakdowns to CLI, JSON, Job Summary, and PR comments
• Add path-specific limits and test requirements
• Add advisory mode for gradual non-blocking adoption
• Validate numeric thresholds and nested path rule configuration
• Expose policy-passed as an Action output

Why?

Teams need to understand why a pull request is risky, apply stricter rules to sensitive areas, and roll out policy without immediately blocking contributors.

How was it tested?

• 24 unit tests pass locally
• JSON and human-readable CLI reports verified locally
• Composite Action smoke test will exercise the updated Action

Closes #5
Closes #6

[github-actions]

PR Sheriff report

Policy: Passed | Risk: HIGH (74/100)

Changed files	Changed lines	Tests changed
9	317	yes

Risk score breakdown

Changed lines	Changed files	Sensitive files	Cap adjustment	Total
+31	+18	+25	0	74

Sensitive files

• .github/workflows/ci.yml