refactor(prover): separate outcome evaluation from rendering

Description

Determine the prover pass/fail outcome once after accepted risks are applied, and make the full and compact renderers presentation-only.

Today, render_compact() and render_report() independently derive the return value from the number of active finding paths. This duplicates domain logic and can classify an unaccepted pathless finding as passing even though the prover contract says any unaccepted finding fails.

Context

Identified while reviewing #2395.

Relevant code:

• crates/openshell-prover/src/lib.rs
• crates/openshell-prover/src/report.rs
• crates/openshell-prover/src/accepted_risks.rs

The public prove() -> Result<i32> contract can remain unchanged. The cleanup should move outcome evaluation out of rendering and remove the unused path arguments from render_compact().

Definition of Done

• Pass/fail is derived in one place after accepted risks are applied.
• Both renderers are presentation-only and do not determine exit status.
• render_compact() no longer accepts unused path arguments.
• No findings returns Ok(0).
• Accepted-only findings return Ok(0).
• Any unaccepted finding returns Ok(1), including a pathless finding.
• Tests cover empty, accepted-only, active, and active-pathless findings.

Read crates/openshell-prover/src/lib.rs, report.rs, and accepted_risks.rs to trace how accepted risks, outcome evaluation, and rendering currently interact. Run the existing prover tests, then verify that one centralized outcome handles empty, accepted-only, active, and pathless unaccepted findings while both renderers remain presentation-only and render_compact() no longer takes path arguments.