[codex] Add stable JSON run summary fields

[stacknil]

Design

This PR extends the existing summary object in sbom-diff-and-risk JSON reports with stable machine-readable run fields.

The base summary remains compact and count-only: added, removed, changed, and risk_counts. unchanged is intentionally not added because the current diff model does not track unchanged components.

summary.policy is emitted only when a policy was applied. It contains policy status and violation counts: status, blocking, warning, and suppressed.

summary.enrichment is emitted only when PyPI provenance or OpenSSF Scorecard enrichment was used. It contains enrichment mode plus provider-specific component counts and status-count maps. This does not add CLI flags, network behavior, or CVE lookup.

Files Changed

• tools/sbom-diff-and-risk/src/sbom_diff_risk/report_json.py
• tools/sbom-diff-and-risk/tests/test_reports.py
• tools/sbom-diff-and-risk/tests/test_provenance_reporting.py
• tools/sbom-diff-and-risk/tests/test_scorecard_reporting.py
• tools/sbom-diff-and-risk/examples/sample-policy-fail-report.json
• tools/sbom-diff-and-risk/examples/sample-policy-warn-report.json
• tools/sbom-diff-and-risk/examples/sample-provenance-report.json
• tools/sbom-diff-and-risk/examples/sample-scorecard-report.json

Validation

Local validation completed:

python -m pytest tests/test_reports.py tests/test_provenance_reporting.py tests/test_scorecard_reporting.py
python -m pytest
git diff --check

Results:

• focused JSON/reporting tests passed: 29 tests
• full suite passed: 147 tests
• JSON golden samples updated
• summary.policy appears only when policy is applied
• summary.enrichment appears only when PyPI or Scorecard enrichment is used

Out of Scope

• No Markdown format changes
• No CLI flag changes
• No workflow changes
• No package version changes
• No new network behavior
• No CVE lookup
• No unchanged count because unchanged components are not tracked by the current diff model

[stacknil]

Reviewed. Scope is clean.

I’m treating this as the v0.6 baseline for machine-readable JSON consumption:

• base summary remains count-only
• summary.policy is conditional on policy usage
• summary.enrichment is conditional on PyPI/Scorecard enrichment usage
• unchanged is intentionally omitted because unchanged components are not modeled
• no CLI, Markdown, workflow, version, network, or CVE behavior changes

Approved to merge after required review gate is satisfied.