feat(scripts): extend trace schema with socketRisk and lastRevalidated

Add socketRisk (9th filter result) and lastRevalidated (nullable ISO date)
to the library-decision trace schema. Downstream enforcement layers
(evaluate-library skill, check.mjs major-bump mode, revalidate.mjs cron)
all depend on these fields being validated at the schema layer first.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/library-decisions/schema.mjs

@@ -17,6 +17,7 @@ const filterResultsSchema = z
     "eu-residency": z.enum(["ok", "n/a", "self-hostable", "fail"]),
     "cve-scan": z.string().min(1),
     "named-consumer": z.enum(["pass", "fail"]),
+    socketRisk: z.union([z.literal("clean"), z.literal("flagged"), z.string()]),
   })
   .strict();
 
@@ -29,6 +30,7 @@ export const traceSchema = z
     date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "date must be YYYY-MM-DD"),
     deciders: z.array(z.string()),
     adr: z.string().nullable(),
+    lastRevalidated: z.string().nullable(),
     "filter-results": filterResultsSchema,
     "verification-commands": z.array(z.string()),
     "accepted-cves": z.array(z.string()).optional(),