feat: enforce reproduce_cmd invariant for every Finding via add_layer

[thefourcraft]

Summary

• BarzelReport::add_layer now normalises each incoming Finding before storing it: if reproduce_cmd is None or blank it is filled with a deterministic fallback (barzel run --layer <name> --json for the four known layers; barzel run --json otherwise)
• Existing runner-specific reproduce_cmd values are left unchanged
• RUNNER_UNAVAILABLE, CACHED, and RUNNER_FAILED findings — which all used ..Default::default() — are covered automatically because every path flows through add_layer
• No schema change: reproduce_cmd remains Option<String> in this PR

Test plan

src/report.rs

• add_layer_fills_missing_reproduce_cmd — None reproduce_cmd is filled with layer-specific fallback
• add_layer_fills_blank_reproduce_cmd — whitespace-only reproduce_cmd is overwritten
• add_layer_preserves_existing_reproduce_cmd — non-empty reproduce_cmd is unchanged
• add_layer_unknown_layer_name_uses_generic_fallback — unknown layer name falls back to barzel run --json

src/orchestrator.rs

• runner_failed_finding_has_reproduce_cmd — RUNNER_FAILED finding has non-empty reproduce_cmd

• runner_unavailable_finding_has_reproduce_cmd — RUNNER_UNAVAILABLE finding has non-empty reproduce_cmd

• cached_finding_has_reproduce_cmd — CACHED finding has non-empty reproduce_cmd

• All 736 tests pass

• cargo clippy --bin barzel -- -D warnings clean

• git diff --check production..HEAD clean