docs(sbom): add minimal CI consumer demo

[stacknil]

Summary

• keep a single minimal GitHub Actions consumer workflow for sbom-diff-risk policy checks
• upload outputs/policy.json before enforcing the tool exit code as the CI result
• remove the older summary-threshold consumer workflow and add regression coverage for the demo shape

Validation

• python -m pytest
• python scripts\validate-reviewer-routes.py
• git diff --check