feat: add report contract linter for evaluation outputs

[luochen211]

Problem

career-ops now relies on evaluation reports as durable artifacts for downstream tooling: tracker links, pattern analysis, dashboard metadata, PDF decisions, and application follow-up. The report format has several implied contract fields, but there is no standalone validator for report files.

This means a report can silently miss key fields such as **URL:**, **Legitimacy:**, ## Machine Summary, score format, or PDF status, and later scripts only fail indirectly.

Proposed solution

Add a lightweight verify-reports.mjs script that scans reports/*.md and validates the report contract:

• header includes **URL:**
• header includes **Legitimacy:** {tier}
• score is parseable as X.X/5 or a documented skip value
• PDF status is present when the report came from auto-pipeline/pipeline
• ## Machine Summary is present and parseable when available
• machine summary fields are from the accepted schema used by analyze-patterns.mjs

Why this fits

This makes evaluation artifacts auditable before downstream scripts consume them. It also gives contributors a focused check to run after changing modes, Gemini output, or report generation.

Non-overlap audit

I checked open PRs before proposing this. This does not overlap with:

• fix(gemini): validate evaluation report shape #819, which validates Gemini evaluation report shape specifically
• feat(cv): add fact validator for generated resumes #822, which validates CV facts, not report artifacts
• fix: add reserve-report-num.mjs to eliminate parallel-window report-n… #803/Fix parallel evaluation ID reservation #781, which address report number allocation

Suggested implementation scope

• New verify-reports.mjs
• Optional npm run verify:reports script
• Add focused tests to test-all.mjs with temporary report fixtures
• Document in docs/SCRIPTS.md

Test plan

• node verify-reports.mjs --self-test
• node test-all.mjs --quick
• Fixture coverage for missing URL, missing legitimacy, malformed Machine Summary, and valid report

[github-actions]

Thanks for opening your first issue, @luochen211! We'll take a look soon.

In the meantime:

• Check SUPPORT.md for setup help
• Join our Discord for quick answers

[santifer]

Closing with its PR under the core-acceptance criterion explained on #890 (core takes what the candidate uses; project-artifact tooling lives outside the core — companion-repo door open).