docs(sbom): document risk model boundary

[stacknil]

Summary:

• Add SBR-02 risk model boundary documentation.
• Separate risk-affecting inputs, context-only fields, and conclusions the tool must never infer.
• Clarify policy/enrichment boundaries around risk bucket generation.

Validation:

• python scripts\validate-reviewer-routes.py
• python -m pytest tests\test_risk.py