[codex] Document JSON report schema and clean public links

[stacknil]

Design

This PR documents the machine-readable JSON report shape for sbom-diff-and-risk and records the stable summary contract added in PR #26.

The new schema document explains the top-level JSON fields, the count-only base summary, the intentional absence of unchanged, conditional summary.policy, conditional summary.enrichment, sorted provider status_counts, stability expectations, and non-claims.

Files Changed

• tools/sbom-diff-and-risk/docs/report-schema.md
• tools/sbom-diff-and-risk/README.md
• tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md
• tools/sbom-diff-and-risk/docs/reviewer-brief.md
• Existing public docs with local absolute Windows links were cleaned to use relative links.

Validation

• git diff --check origin/main..HEAD
• Scanned public Markdown for D:/OneDrive and D:\OneDrive; no matches remain.
• Checked changed Markdown links; relative file links resolve.
• Confirmed no runtime source, workflow, pyproject.toml, or version changes.

Out of Scope

• No runtime behavior changes.
• No CLI changes.
• No workflow changes.
• No package metadata or version changes.