Risk findings

Token risk assessments from the token-risk agent. Ratings separate verified facts from derived findings and explicit unknowns — the agent never states a guess as a fact.