fix: distinguish completed contributor risk assessments from execution failures

[altrudev]

Closes neither policy gate automatically; addresses #58.

The vendored profile, credential, and cluster scripts return exit 0/1/2 for LOW-or-NONE/MEDIUM/HIGH. The composite wrapper previously treated 1/2 as process failures before inspecting valid JSON. This PR preserves those risk decisions and validates an explicit JSON risk against the scanner's exit status. Unknown/malformed/non-object/missing or contradictory outputs, unexpected exit codes, timeouts, and process failures remain execution errors; NONE normalizes to LOW and UNKNOWN retains its elevated uncertainty semantics.

Adds table-driven contract and adversarial tests in .github/actions/contributor-check/tests/test_risk_exit_contract.py: valid risks, mismatched exit/risk, malformed payloads, timeout and OSError, aggregate HIGH/UNKNOWN preservation.

EDRG status: source correction and regression fixtures committed; tests and hosted CI not yet confirmed. Maintain existing HIGH labels, risk thresholds, and maintainer approval requirements. No production conformance assertion. Security-sensitive vendored modification requires maintainer review.

Val Rukhaylo / Altru.dev

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	NONE
Overall	HIGH

Automated check by AGT Contributor Check.

[imran-siddique]

@altrudev confirmed on main. The contributor check on this PR (run 38461229558) logged contributor_check.py exited 2: no stderr and reported Overall risk: ERROR, so since #46 a real MEDIUM or HIGH in this repo has come out as an error with no label.

CI has run now. tests fails on two existing cases, test_computed_risk_passes_through[MEDIUM-MEDIUM] and [HIGH-HIGH], because their stub prints the risk and exits 0, which is the contract #46 got wrong. Have the stub exit 1 for MEDIUM and 2 for HIGH, the way the real scanners do, and put back the second blank line before _aggregate_risk. Mark it ready once tests is green.

[altrudev]

@imran-siddique Applied the exact requested CI-test correction in 4a91fd079bb0b2907caa54f35cb8be95ef1d821d: MEDIUM scanner stubs now exit 1, HIGH exit 2, and the second blank line before _aggregate_risk is restored. Independently ran .github/actions/contributor-check/tests on Prometheus: 38 passed, 23 subtests passed; git diff --check clean. The current upstream workflow result for this head is action_required, not green, so I am leaving the PR in draft rather than declaring it ready. Once the authorized maintainer permits the fork workflow and CI passes, we can mark it ready for review. I have not relaxed risk thresholds or approval gates.

[imran-siddique]

Applied as asked: the stubs exit 1 for MEDIUM and 2 for HIGH, and tests and vendor-integrity pass on 4a91fd0. This closes #58.