docs(case): add one-page evidence trace

[stacknil]

Summary

• add a one-page incident-style case tracing five raw SSH records through normalized events to one explainable finding
• state the supported conclusion, non-verdict boundary, parser limitations, and context required before disposition
• bind every displayed raw line and finding field to the existing sanitized sample and golden report fixture
• link the compact case from README, reviewer path, the full case study, and changelog

Validation

• cmake -S . -B build
• cmake --build build
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check
• evidence contract check: 5 raw lines and brute-force finding fields match golden fixtures
• one-page limit check: 652 words
• local Markdown link check: 60 links
• privacy/secret marker scan of changed docs