feat: add baseline governance

[alxxjohn]

Summary

• add backward-compatible baseline audit, prune, and policy subcommands
• expose opt-in individual suppression records with exact, context, and content match evidence
• add ownership/risk reporting, deterministic samples, stale-only atomic pruning, and suppression-growth policies
• preserve v1.7.3 collision semantics: every matching baseline entry stays active and collisions are reported
• document configuration, CI workflows, review guidance, and exit behavior in the README and public docs

Verification

• go test ./...
• go vet ./...
• make fmt-check
• make codeguard-ci
• clean CLI build
• git diff --check

The repository self-scan passes its fail gate and reports only the pre-existing file-size/declaration warnings. golangci-lint was not available locally, so the hosted CI job remains the strict-lint authority.