docs(sbom): publish bounded policy review case study

[stacknil]

Summary

• Add a short case study on SBOM diff as a bounded policy review artifact.
• Separate component diff evidence, heuristic risk buckets, and local policy decisions.
• Link the case study from the flagship tool entry point.

Validation

• python scripts/validate-reviewer-routes.py (passed)
• 79 reviewer-surface Markdown files link-checked
• workflow path filters and coverage checks passed

Boundaries

• No CVE, malware, exploitability, or package safety verdict claim.
• Checked-in examples remain no-network review evidence.