feat(enrichment): ReDoS scanner on added/changed regex - #1601

The evidence packet contains zero hydrated pull requests (candidate_pr_count=0, hydrated_pr_count=0) because the GitHub PR search returned no authored pull requests. Without patch-level data, it is impossible to inspect code changes, file paths, execution paths, dependencies, or lifecycle hooks for any of the contributor's 62 claimed PRs. Behavioral metadata shows a 32-day-old account that opened 62 PRs across 9 repositories in a 3-day span (2026-06-21 to 2026-06-24), with zero merged, zero rejected, and no issue references in any recent PR. While this burst pattern is atypical, no patch-level evidence exists to confirm or refute malicious intent. Per instructions, when evidence is insufficient to judge, the verdict must be inconclusive rather than safe.