Document and lock the check-decisions JSON contract

[thangldw]

Outcome

Give CI users a content-free example of proofline check-decisions --format json and protect its public output contract with a focused CLI regression test.

Acceptance criteria

• docs/stale-decision-demo.md includes one machine-readable example for the review-required case.
• The example contains no source content, private path, credential, or prompt.
• A CLI regression test fixes the public keys and exit behavior.
• The test does not assert run-specific IDs or hashes.
• Missing or corrupt provenance remains an explicit fail-closed result.
• Relevant test and quality commands pass.

Scope

Do not add a new output format or change the decision-health algorithm.