Add CVE backport reachability gates

[Errordog2]

Summary

• add fix provenance inputs for upstream fixed versions, vendor backports, VEX/workaround decisions, and runtime evidence
• require backport proof through vendor advisory, package changelog/security tracker, installed build ID, and scanner source awareness
• add runtime loaded-path and reachability confidence evidence before downgrading severity as not affected or not reachable

Addresses #2501.

Validation

• git diff --check
• Markdown fence balance check
• targeted marker check for backport proof, runtime reachability, loaded library path, reachability confidence, output evidence tables, and v1.0.1