docs(sbom): clarify risk model non-claims

[stacknil]

Summary

• add an explicit non-claims section to the risk model boundary
• distinguish CVE scanning, malware scanning, and package safety verdicts
• enforce all three boundaries in focused docs and reviewer-route validation

Validation

• python -m pytest tests/test_risk_model_boundary_docs.py (2 passed)
• python -m pytest (180 passed)
• python scripts/validate-reviewer-routes.py
• git diff --check
• scoped privacy and credential pattern scan