[v0.3] Lock down golden outputs and regression fixtures for report contracts

[stacknil]

Summary

Lock down golden outputs and regression fixtures for report.md and report.json so key user-visible output contracts stay deterministic across local iteration and future refactors.

Scope

• add sanitized regression fixtures that exercise report generation end to end
• check in golden report.md and report.json outputs for stable, reviewable comparisons
• focus assertions on key output contracts rather than incidental formatting noise
• keep fixture data public-safe and easy to diff in review
• do not add a devcontainer in this issue

Acceptance Criteria

• repository includes deterministic golden-output coverage for the main report paths
• tests fail when key report.md or report.json contract fields change unexpectedly
• fixture inputs and expected outputs remain sanitized and suitable for a public repo
• golden updates are straightforward to review when output behavior intentionally changes
• work stays scoped to regression coverage and output contracts, not new detection features