refactor(result): centralize level-failure policy

[solloek369-arch]

Refs #83

Small, self-contained refactor that centralizes the existing
finding→level failure-contribution decision so the CLI and the JSON
report read it from one place rather than each deriving it.

Scope:

• no new report wire/version
• no obligation registry or accounting surface
• no verdict-policy change
• no new checker semantics

This is the primitive the larger #83 obligation-accounting work would
build on; it is useful on its own and lands nothing user-facing beyond
the existing report.

Testing:

• focused: 16 passed
• full suite: 518 passed, 5 xpassed

[imran-siddique]

This is the right way to open #83 and I want to name why, because the instinct is more transferable than the diff.

I asked on #83 that no report ship an unreconciled obligation registry, since a conformance suite's output is a claim about conformance and a machine-readable list of unchecked obligations is a public statement about it. The obvious reading of that is "wait". You found the other one: extract the primitive the accounting needs, ship it with none of the surface, and leave the reconciliation question untouched.

Your scope list is the part that makes it reviewable:

no new report wire/version, no obligation registry or accounting surface, no verdict-policy change, no new checker semantics

Four things it is not, stated before anyone has to ask. Centralizing the finding-to-level decision so cli.py and report.py read it from one place instead of each deriving it is worth having on its own merits, independent of whether #83 ever lands in the shape it is currently drafted.

Seven checks, only the maintainer gate red. Merging.