v0.4.0 cloudg ingestion mode

Ingest mode. cloudg can now work entirely from scanner outputs you already have, with no cloud credentials and no scanner binaries on the machine.

Added:

• cloudg ingest CLI command. Takes --prowler, --scoutsuite, --checkov and --trivy paths (file or directory, each repeatable, any combination), runs the normaliser and the check-equivalence merge over them, and renders the HTML and JSON reports.
• parse_report(path) classmethods on ProwlerScanner, ScoutSuiteScanner, CheckovScanner and TrivyScanner. Each parses the tool's native output format directly. Trivy image and filesystem reports are told apart by the ArtifactType field.
• cloudg.ingest module with parse_report(tool, path) and ingest_reports(mapping).
• CloudGEngine.ingest_reports(), CloudGEngine.normalise_findings() and CloudGEngine.run_from_reports() / run_from_reports_sync() for embedders.
• Feature documentation: docs/DOCUMENTATION.md, a rendered handbook at docs/index.html, and this changelog.

Fixed:

• The publish workflow now sets an explicit least-privilege permissions block (CodeQL actions/missing-workflow-permissions).

Full Changelog: v0.3.2...v0.4.0