fix: reject invalid trace line numbers

[badmuriss]

Summary

Require every trace[].line reference to be a positive source line and add regression coverage for the findings validator.

Why

The schema currently accepts any integer. As a result, confirmed findings with line 0 or a negative line pass validation even though those locations cannot refer to source code. This weakens the machine-readable evidence contract used by independent verification.

The patch adds minimum: 1 to the schema and teaches the zero-dependency schema interpreter to enforce numeric minimum constraints generically.

Testing

• npm test
• Direct validator smoke test with a valid confirmed finding

The test suite executes validate-findings.cjs as a subprocess and covers a positive line, zero, and a negative line.