fix(sbom): use canonical versions for risk classification

[stacknil]

Fixes #118.

Summary

Use the existing canonical identity versions in _version_change_findings()
so risk classification retains version evidence present only in PURLs.
Add focused risk and CycloneDX/SPDX policy/report regressions and document
the evidence source.

Why

The diff already recognizes a PURL-only 1.2.3 to 2.0.0 change, but the risk
layer compares two absent raw versions and emits no version finding. An
existing major_upgrade blocking rule consequently returns 0.

Behavior change

• Known canonical versions use the existing major recognizer or
  version_change_unclassified fallback. Minor changes and downgrades are not
  promoted to major upgrades; missing canonical versions stay unknown.
• Canonical equality also removes a whitespace-only false version finding.
• Restored findings can make matching block rules return 1; removing the false
  finding can remove its block. Warnings and suppressions retain exit 0.
  Corrected matches, including suppressed matches, use existing policy_matched
  confidence. Unmatched rules do not change policy decisions or confidence.

Validation

Base: 888d28f8836bda0898cc6a64b26f1c02bcf4868a.
From tools/sbom-diff-and-risk, the exact four-file candidate passes:

• python -m pytest tests/test_risk.py tests/test_version_evidence.py -q: 57 passed.
• python -m pytest -q: 272 passed, including existing golden/schema tests.
• Ruff correctness checks (E4,E7,E9,F) and clean-base patch application checks.
• 18 targeted policy comparisons: unmatched decisions/confidence unchanged;
  changes confined to corrected findings matching existing rules.

Preserved red run with the final regressions against unchanged production:
25 failed / 32 passed. Existing 32-case synthetic evidence was retained.
Tests used Windows/Python 3.12.7 with network connections blocked. No Python
3.11 interpreter was found in inspected locations; Linux/3.11 was not run locally.

Compatibility

Canonicalization rules, conflict rejection, opaque identities, raw component
fields/evidence, SemVer criteria, policy rules, report schemas, ordering, and
offline defaults are unchanged. No goldens or dependencies change. Markdown
continues to display raw version fields; PURL-only version cells remain blank.

Rollback: revert this change; no data or schema migration is required.