feat: classify release vulnerabilities by response urgency (#1922)

* feat: classify release vulnerabilities by response urgency

Replace the raw High/Critical release gate with evidence-based classification using dependency scope, release-specific reachability assessments, CISA KEV, and fix availability. Preserve daily default-branch scanning and keep artifact-bound SBOMs for the next phase.

* refactor: separate release integrity from OSV exposure

Keep the phase-one gate focused on development scope, exact affected/not-affected assessments, CISA KEV, and High/Critical triage. Remove artifact compromise and speculative impact dimensions from advisory policy, and fail only on plausible evidence-integrity errors.

* fix: harden release vulnerability decisions

Treat ambiguous OSV fix intervals conservatively, preserve explicit affected assessments for development dependencies, and retain the KEV evidence used by each evaluation.

* fix: reject ambiguous OSV range events

Only report a fix when the ecosystem range contains exactly one introduced event followed by one fixed event.