chore(codeql): break static model import cycles

[saagpatel]

What

• Breaks the static CodeQL cyclic-import chain rooted in src.models.
• Keeps AuditReport.from_audits as the public factory API while deferring report assembly dependencies dynamically.

Why

• The remaining open CodeQL family on main is py/cyclic-import.
• The model layer was importing scorer/report modules that import the model layer back, creating broad static cycles across analyzers, scorer, and reporting helpers.

How

• Converts the report-only imports in AuditReport.from_audits to call-time dynamic imports through importlib.import_module.
• Leaves the dataclasses and output shape unchanged.

Testing

• python3 -m pytest -q -p no:cacheprovider -> 2085 passed, 2 skipped, 1 warning.
• ruff check src/ tests/ -> All checks passed.

Performance Impact

• None expected for normal operation; the same modules are loaded when report assembly runs.

Risk / Notes

• Low behavior risk, but CodeQL needs to confirm this resolves the static cycle family on the public branch.