Populate AnalysisResult.riskFiles (per-file risk aggregation)

[vedant7007]

Feature: populate AnalysisResult.riskFiles

AnalysisResult declares a riskFiles: RiskFile[] field (and RiskFile is a documented type), but pipeline.ts hardcodes riskFiles: [] — it's never populated. So the per-file risk view that reporters could surface is always empty.

Proposal

Add a pure computeRiskFiles(changes) in src/core/risk.ts that aggregates breaking changes per file, counts confirmed broken call sites, and assigns a risk tier:

• critical (3+ broken call sites), high (1–2), medium (breaking surface, no confirmed broken caller).
• Sorted deterministically (tier, then path). Wired into pipeline.ts so it flows through to reporters (JSON output shows it immediately).

Pure function → unit-testable with plain mock changes, no git/tree-sitter.

Acceptance criteria

• computeRiskFiles groups breaking changes by file with a tier + reason + change count
• Non-breaking changes excluded; same-file changes aggregated
• Deterministic ordering
• pipeline.ts populates riskFiles
• Covered by unit tests

Contributing as part of Elite Coders Summer of Code (ECSoC 2026).