Root Child DOX Index assembled, plus a per-module AGENTS.md across the tree
(core/*, infrastructure/*, apps/*, testing/*, and docs/examples/frontend/etc),
each following the DOX section shape: Purpose, Ownership, Local Contracts,
Work Guidance, Verification, Child DOX Index.
Risk tier is now derived from the worst validation issue severity and
the issues that drove it travel with the summary, so consumers can show
operators why a tier was assigned instead of an opaque level.
- Add RiskSummary.rationale (defaulted, backward-compatible) holding
human-readable '[code] message' lines from the validation report
- Pin severity -> risk mapping: ERROR->HIGH, WARNING->MEDIUM, INFO->LOW
- DefaultRiskAssessor folds the validation-driven level into the summary
kami