refactor(prover): define and surface accepted-risk provenance

Description

Define how accepted-risk attribution is retained and surfaced when findings are accepted.

The accepted-risk loader parses accepted_by, but matching and rendering never use it. Fully accepted findings retain only one reason, and partially accepted findings discard the provenance of the paths that matched accepted-risk entries.

Context

Identified while reviewing the call chain rooted at prove() after #2395.

Relevant code:

• crates/openshell-prover/src/accepted_risks.rs
• crates/openshell-prover/src/finding.rs
• crates/openshell-prover/src/report.rs

This is audit-facing behavior, so the representation should be agreed before implementation. In particular, define whether provenance belongs on findings, individual paths, or a separate acceptance result.

Definition of Done

• Define the accepted-risk provenance model, including accepted_by and reason.
• Preserve provenance when multiple accepted-risk entries match.
• Define and preserve provenance for partially accepted findings.
• Surface the agreed attribution in relevant report or structured output.
• Tests cover complete, partial, pathless, and multiple-entry acceptance.

Trace the call chain rooted at prove() and read crates/openshell-prover/src/accepted_risks.rs, finding.rs, and report.rs first. Establish the accepted-risk provenance model before implementation, including complete, partial, pathless, and multiple-entry matches. Done means provenance is preserved and surfaced in relevant report or structured output, with tests covering those cases.