feat: add supply chain policies, semantic review, and AI change risk

[alxxjohn]

Summary

This PR expands CodeGuard’s review surface in three areas:

• adds a new supply_chain check family for lockfile, pinning, and license-policy enforcement
• adds command-backed semantic AI review with framework-aware request enrichment
• adds AI change-risk artifacts and findings to highlight higher-risk AI-shaped changes

What Changed

• introduced supply_chain checks, artifacts, config, rule catalog entries, and tests
• added semantic review support for contract drift, error-message mismatch, test coverage, and test adequacy
• enriched semantic requests with framework/context hints for Express, React, and Next.js
• added change_risk artifacts plus quality.ai.change-risk
• surfaced semantic runtime failures as quality.ai.semantic-runtime instead of failing silently
• restored documented snake_case YAML config support across config load/write paths
• updated docs and examples to match current semantic runtime behavior and config schema

Validation

• ran targeted semantic and config regression tests
• ran full make ci
• verified repo self-scan includes Supply Chain and passes with the updated snake_case config

Notes

• semantic review can use a command-backed provider config or fall back to CODEGUARD_SEMANTIC_COMMAND
• when semantic review is enabled but misconfigured or broken, CodeGuard now emits an explicit fail-level runtime finding