Lock sample config and reviewer evidence contracts

[stacknil]

Summary

• Treat assets/sample_config.json as a tested default-equivalent config fixture
• Assert --config assets/sample_config.json produces the expected sample report contract fields
• Clarify reviewer navigation, rule catalog linkage, and local test expectations in docs

Validation

• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check origin/main...HEAD
• Privacy/security scan over committed diff for local paths, private keys, common token prefixes, identity markers, and non-documentation IPv4 literals