feat: add opt-in recommended check defaults

[alxxjohn]

Summary

This PR makes CodeGuard's recommended check-family defaults explicitly opt-in
while preserving existing behavior for live SDK and configuration consumers.
It also clarifies the default-policy contract, composes enterprise policy from
strict policy, improves validation coverage, and tunes duplicate-code
thresholds to reduce noisy findings across real repositories.

What changed

Opt-in recommended check policy

• Added checks.use_recommended_defaults.
• Added checks.disabled for explicit final-precedence exclusions.
• The recommended baseline enables exactly:
  • quality
  • design
  • security
  • prompts
  • ci
• performance and supply_chain remain opt-in.
• context and contracts retain their existing scan-mode-aware behavior.
• Entries in checks.disabled are applied last and override both recommended
  activation and explicit section enablement.

Example:

checks:
  use_recommended_defaults: true
  disabled:
    - prompts

Backward compatibility

• Existing configurations behave as before when
  use_recommended_defaults is absent or false.
• Existing top-level section field types were preserved.
• Existing SDK functions, aliases, profile names, and threshold semantics
  remain available.
• Documentation calls out that adding fields to the exported CheckConfig
  alias can affect rare unkeyed Go composite literals; keyed literals remain
  the supported robust form.

Validation and defaults

• Rejects blank, duplicate, or unknown checks.disabled entries.
• Accepts only canonical section names, including supply_chain.
• Validates negative core quality and design thresholds consistently.
• Keeps explicit design-rule zero overlay behavior unchanged.
• Makes repeated default application idempotent.

Profile design

• Enterprise now composes the complete strict policy and adds only enterprise
  release/automation requirements.
• Added hand-derived profile-equivalence tests to prevent threshold drift.
• Added a deterministic generated profile comparison to the checks
  documentation.

Duplicate-code threshold tuning

The previous thresholds were aggressive enough to flag conventional
boilerplate and small incidental similarities across multiple repositories.

Profile	Previous	New
Baseline	60	90
Startup	90	120
Strict	45	60
Enterprise	45	60
AI-safe	50	75

These values keep strict and AI-focused profiles more sensitive while reducing
pressure to introduce premature or overly generic abstractions.

SDK and documentation

• Clarified the difference between ExampleConfig() and ApplyDefaults().
• Documented activation precedence, compatibility behavior, supported disabled
  names, and profile independence.
• Added public Go documentation to the touched SDK surface.
• Replaced machine-specific absolute documentation links with
  repository-relative links.

Why

CodeGuard previously had several related notions of defaults: a complete
starter configuration, missing-field normalization, and policy profiles.
Because ordinary Go booleans cannot distinguish an omitted value from explicit
false after decoding, silently enabling existing check families would risk
changing behavior in live SDK integrations.

The new field provides a deliberate migration path: consumers opt into the
recommended baseline, retain existing behavior otherwise, and can explicitly
disable individual families with deterministic precedence.

The duplicate-code adjustment addresses a second real-world default-policy
issue: very small token thresholds frequently identify language idioms,
serializers, adapters, or test setup rather than abstractions that genuinely
share a reason to change.

Test strategy

Added and updated tests covering:

• legacy behavior without opt-in;
• exact recommended baseline activation;
• performance and supply-chain opt-in behavior;
• context/contracts preservation;
• disable precedence across every supported section;
• blank, duplicate, and unknown disabled-name validation;
• JSON and YAML round trips;
• idempotent default application;
• negative threshold validation;
• baseline/startup/strict/enterprise/AI-safe policy equivalence;
• generated documentation freshness;
• updated clone thresholds.

Verification

• go test ./... — 15 packages passed, 0 failed
• go vet ./... — passed
• make fmt-check — passed
• focused configuration and clone tests — passed
• make codeguard-ci — completed with no failures; only existing repository
  warnings remain
• git diff --check — clean
• independent whole-diff review — no Critical, Important, or Minor findings