fix(statement): prefix schema errors with their JSON path

[open-coder-ai-org]

What

statement.validate() returned jsonschema's bare e.message, so a const mismatch rendered as
'claimed' was expected with no indication of which field failed. run/manifest.py:validate()
already had the fix ("/".join(absolute_path) + ": " + message), so this extracts that
convention into a shared module, context_report.schema_errors, that both validators now call —
one formatter instead of two copies.

Two improvements over the manifest.py precedent, both requested by the brief:

• A root-level error (e.g. a missing top-level required field) now gets a stable (root) prefix
  instead of an empty one (": message").
• A const failure additionally names the expected and offending values on the same line, e.g.
  predicate/attributes/3/environmentSensitive: expected True, got False.

verify.py and cli.py are unaffected — they only consume the returned list[str].

Tests added to tests/test_schema.py: a const mismatch (cost.latency_ms's
environmentSensitive), a nested if/then failure under a subjectKind block
(instruction-file requiring a row's result to be NotApplicable), and a root-level error
(deleting _type) — each asserting the exact path-prefixed message. No golden or fixture files
captured the old bare-message text, so nothing else needed updating; docs/ and README.md only
show validate() used generically (errors = validate(stmt)), never a sample error string.

spec/ is untouched — this is renderer-side only, per the brief.

Definition of done

• python -m ruff check . and python -m ruff format --check . clean
• python -m pytest -q green; new checks have attack + ordinary-data tests
• Schema changes: n/a — spec/attestation/v0.1/schema.json is untouched
• chock check and chock sync --repo . --check clean, if .agents/policies/ changed — n/a, no .agents/policies/ changes

Claims

• No row is described as re-derivable unless it actually recomputes from the subject
  plus its recorded configuration and carries an inputHash. A row that could not be
  measured says NotAvailable, Error, or NotApplicable and why. (unchanged by this PR)

Closes open-coder-ai/org-plan#166.

🤖 Generated with Claude Code