feat(disposition): separate the assessment axis from the action

`decide` returned a `Disposition` — WARN / QUARANTINE_REVIEW / FAIL_SECURE —
which names an ACTION. But BRIEF design principle 4 says the library reports
and the pipeline decides, and disposition.py admitted the gap in its own
docstring: "It imposes no blocking of its own." So we returned an action we
cannot enforce, having discarded the judgement that produced it. A consumer
wanting different behaviour had to reinterpret the action itself — which is
why a consumer ends up pinning our GRADING: the action was all they got.

`Risk` (NONE/LOW/ELEVATED/SEVERE) now carries that judgement, and
`Policy.action_map` lets a caller map it to their own action. Both overlays
move the assessment rather than the action, so a custom map cannot silently
drop the compound escalation or the quarantine floor. `guard`'s fail-closed
path pins both axes and deliberately bypasses the map: downgrading SEVERE
means "I accept this class of finding", never "I accept a crashed scanner".

`DispositionResult.assessment` is required with no default. `Risk.NONE` is the
natural-looking default and the wrong one — a site that forgot the field would
report clean, and the axis would fail open.

MEASURED ADDITIVE, not assumed:
  - 703 -> 715 tests, no existing test changed
  - coverage matrix 128/128 recall, 6/6 documented gaps still hold
  - the PRESET_USER_UPLOAD grading table locked in 0.3.1 re-measured row by
    row: ordinary link/image/autolink/refdef -> warn on BOTH doors, unchanged

Both locked consumer promises in docs/PLAN-v1.md were checked against that
measurement and neither fires: the grading is untouched (linkedin-studio), and
the relative-target asymmetry is untouched (llm-ingestion-okf).

Scope held to disposition, per PLAN-v1.md:380. Version stays 0.4.0; the 0.5.0
bump lands in its release commit with all five version surfaces at once —
that is the fix for the defect where the v0.4.0 tag carried a 0.3.4 README.

Records limitation 32: `Severity` still carries disposition intent on the
DETECTION side, which this change does not address and cannot without moving
the grading.

src/llm_ingestion_guard/__init__.py

@@ -40,8 +40,10 @@ from .disposition import (
     Policy,
     Trust,
     Provenance,
+    Risk,
     Disposition,
     DispositionResult,
+    DEFAULT_ACTION_MAP,
     PRESET_TRUSTED_SOURCE,
     PRESET_USER_UPLOAD,
 )
@@ -135,9 +137,9 @@ __all__ = [
     "neutralize", "NeutralizeResult",
     # output-side
     "scan_output", "scan_secret_egress", "scan_active_content",
-    # disposition
+    # disposition — `Risk` is the assessment axis, `Disposition` the action
     "decide", "guard", "Policy", "Trust", "Provenance",
-    "Disposition", "DispositionResult",
+    "Risk", "Disposition", "DispositionResult", "DEFAULT_ACTION_MAP",
     "PRESET_TRUSTED_SOURCE", "PRESET_USER_UPLOAD",
     # contract asserters
     "assert_tool_less", "assert_credential_allowlist",