docs(evidence-pipeline): trace CCI-003 to investigation_summary schema

[vaishnavidesai09]

Closes #76.

• Traces CCI-003 from demos/config-change-investigation-demo/artifacts/investigation_summary.json
  to schemas/investigation_summary.schema.json, confirming it satisfies
  investigation_id, severity, and evidence_counts schema rules.
• Small doc correction: clarifies in docs/vocabulary.md that
  evidence_counts: 0/0 means no evidence attached within the bounded
  window/scope, not a cleared/low-risk verdict — severity is set independently
  from the triggering change.
• Adds a worked trace section to docs/evidence-pipeline-contract.md.
• Adds a targeted regression test for the CCI-003 trace.

Verified locally: python scripts/regenerate_artifacts.py --check and full
pytest pass (189 passed), no artifact changes. No demo-matrix expansion,
no live telemetry, no incident verdict.