fix: stop deriving risk from demo code, and point at the next command

[aryamthecodebreaker]

The bug: a high-severity risk from a file the ranker discounted

Express ships examples/auth/. Asked about request body parsing, FixMap ranked that demo file eighth at low confidence, score 6, explicitly labelled "example or demo code deprioritized" — and then reported:

## Risk Map
- **high** authentication: authentication-related files are affected

Nothing in the task or the real answer touches authentication. This is worse than a bad ranking: the reader has no ranked file to sanity-check the claim against, and it is precisely the confident-but-wrong output the whole diagnostics layer exists to prevent.

Risk notes now ignore demo, example, sample, and fixture directories when reading ranked context. Changed files still count wherever they live — a diff is fact, not a guess.

Verified all three directions:

Input	Risk
examples/auth/index.js ranked only	none ✅
examples/auth/index.js changed	authentication ✅
src/auth/login.ts ranked	authentication ✅

Also: the CLI now points at the next useful command

Both --explain and verify were reachable only from --help, and a feature nobody discovers may as well not exist.

$ fixmap plan --issue "..." --format json --output plan.json

After you make the change, check it against this plan:
  fixmap verify --report plan.json --diff main...HEAD

$ fixmap plan --issue "improve DX when running into errors"

Expected a file that is not listed? Ask why it was left out:
  fixmap plan --issue "<same task>" --explain <path>

Deliberate constraints: hints go to stderr, so reports piped to a file, parsed as JSON, or posted by the Action are byte-identical to before; at most one per run; and only when the situation makes the suggestion obviously useful — a strong result printed to stdout stays silent.

The README also gains a four-row command table under the install line, so the two newer commands are visible to someone scanning rather than only to someone reading.

Verification

128 core tests, npm run ci green, all three evaluation suites byte-identical.

🤖 Generated with Claude Code