CREATIVE: Publish core.vendor-risk-questionnaire-score (vendor risk questionnaire scorer)

## Why (creative vignette)

Procurement / security reviews score vendor questionnaires (yes/no/partial answers with weights) into a band before onboarding. Creative freedom on the vignette details; governance requires a **scored, explainable, fail-closed** capability.

## Guardrails (required)

- Machine-readable contract (inputs/outputs/errors)
- Deterministic scoring (no silent LLM invent). Optional free-text answers may be ignored or marked unscored — do not invent scores from prose unless fail-closed heuristic is explicit
- Tests + publish checklist
- Not a thin LLM wrapper / generic util
- Business/agent-governance domain

## One-PR ask

Publish **`core.vendor-risk-questionnaire-score@1.0.0`**:

**Suggested contract:**
- Inputs: `responses` array of question_id + answer (`yes|no|partial|unknown`); `catalog` of question weights/scores/`unknown_policy` (`fail_closed|neutral`); `bands`; `policy_version`
- Outputs: `score`, `band`, `unanswered`, `contributions[]`, `ok`, `reason_code`
- Unknown critical questions with `fail_closed` → `ok: false` / band withheld

Creative freedom: choose the questionnaire theme (security, privacy, ESG, financial stability) within guardrails.

Follow [`CONTRIBUTING.md`](https://github.com/traverse-framework/registry/blob/main/CONTRIBUTING.md) and [`capabilities/README.md`](https://github.com/traverse-framework/registry/blob/main/capabilities/README.md) publish checklist.

- Include `capability-src/` with real Rust tests meeting registry coverage gates (`functions` 100%, lines/regions ≥ 95%)
- Use `traverse-cli capability publish` (or the documented scaffold) so `artifact.digest` / `artifact.url` survive
- Declare `authoring.method` (`human` or `llm-assisted`)
- Ensure every `use_cases[].persona_ref` resolves (scaffold personas if needed)
- Run `bash scripts/ci/pre_pr_check.sh ` before opening
- One capability per PR; branch from `origin/main`, not another `publish/*` branch

**Apps are not ready — publish the capability only.** No app wiring, no demo product surface.

## Out of scope

- Full GRC platforms
- Scraping vendor websites
- LLM "summarize this PDF security packet" as the product

## Done when

- CI green; published in next index
- Tests: weighted score, band mapping, fail closed on unknown critical Q

## Host / deps notes

**Pure WASM.** No network. Catalog supplied by caller.

## Labels

`help wanted` · `enhancement` · `no-spec-needed`

Start with CONTRIBUTING.md and capabilities/README.md, then inspect the documented scaffold and existing capability-src/ Rust tests. Run the publish checklist, including bash scripts/ci/pre_pr_check.sh , and verify the weighted score, band mapping, and fail-closed unknown-critical-question cases. Done means the pure WASM capability publishes with its digest and URL, resolved persona references, declared authoring method, and green coverage gates.

Written by the indexing model from the issue text.