feat(report): add finding explainability fields

[stacknil]

Summary

• add rule_id, threshold, observed_count, grouping_key, and evidence_event_ids to JSON findings
• carry deterministic line-based event IDs from normalized auth signals into detector findings
• update report contract golden JSON snapshots and document the explainability fields

Validation

• git diff --check
• cmake -S . -B build
• cmake --build build with sanitized Path/PATH environment
• ctest --test-dir build -C Debug --output-on-failure