[C2] Surface risk items in `plan` table/JSON/YAML output

[leo-aa88]

Problem. Structured risk is only useful if it renders cleanly in all output modes.

Proposed change. Render the C1 RiskSummary in -o table|json|yaml. Table mode groups by
severity; JSON/YAML expose the structured list for CI gating.

Affected files. internal/plan/output.go, internal/render/*.

Acceptance criteria. All three output modes include risk items; golden tests updated.

Depends on. #165