Integrate Infigraph into the existing review receipt

[wryenmeek]

What to build

Extend the existing commit-bound cross-functional review evidence receipt with an optional Infigraph result so reviewers can find the analysis without introducing a second merge gate.

Acceptance criteria

• The receipt records the Infigraph tool version, base SHA, head SHA, completion status, failure reason when applicable, and summarized advisory impacts.
• Receipt validation rejects mismatched or missing commit identity and malformed normalized Infigraph data.
• A completed analysis with findings remains advisory and does not require findings to be clean.
• An unavailable or failed analysis is visibly represented as incomplete and preserves the conventional source-and-test review path.
• Existing cross-functional review gate behavior remains unchanged, with focused tests for backward compatibility and the new optional section.

Blocked by

• Add the knowledgebase CI-7 advisory analysis #598