[codex] Sync policy JSON reviewer docs

[stacknil]

Brief Design Summary

This PR syncs reviewer-facing documentation with the newly checked-in --policy-json evidence path.

The reviewer brief now calls out compact summary.json and policy-only policy.json sidecars for CI consumers. The reviewer evidence pack now includes a reproducible strict-policy --policy-json command, explains the expected exit code 1, and links the checked-in sample-policy.json and copyable GitHub Actions policy consumer example.

This is docs-only. It does not change runtime behavior, workflows, package metadata, release tags, or publishing status.

Files Changed

• tools/sbom-diff-and-risk/docs/reviewer-brief.md
• tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md

Validation

• git diff --check passed.
• Confirmed relative link targets exist.
• Checked touched files for Unicode Cf/Cc control or format characters; no non-tab/newline matches found.
• Confirmed package version remains 0.8.0.
• Confirmed .github/workflows is unchanged.
• No Python tests run because this is docs-only.

Out of Scope

• No runtime behavior changes
• No CLI changes
• No JSON schema changes
• No workflow changes
• No package version bump
• No tag or GitHub Release
• No PyPI/TestPyPI publishing
• No production PyPI workflow