refactor(prover): separate outcome evaluation from rendering #2411

Description

Determine the prover pass/fail outcome once after accepted risks are applied, and make the full and compact renderers presentation-only.

Today, render_compact() and render_report() independently derive the return value from the number of active finding paths. This duplicates domain logic and can classify an unaccepted pathless finding as passing even though the prover contract says any unaccepted finding fails.

Context

Identified while reviewing #2395.

Relevant code:

• crates/openshell-prover/src/lib.rs
• crates/openshell-prover/src/report.rs
• crates/openshell-prover/src/accepted_risks.rs

The public prove() -> Result<i32> contract can remain unchanged. The cleanup should move outcome evaluation out of rendering and remove the unused path arguments from render_compact().

Definition of Done

• Pass/fail is derived in one place after accepted risks are applied.
• Both renderers are presentation-only and do not determine exit status.
• render_compact() no longer accepts unused path arguments.
• No findings returns Ok(0).
• Accepted-only findings return Ok(0).
• Any unaccepted finding returns Ok(1), including a pathless finding.
• Tests cover empty, accepted-only, active, and active-pathless findings.