add producer-side constructors for RISC events

[hstern]

What

Adds a New… constructor for every non-deprecated RISC event type so a consumer can build an event in a single expression with the required fields supplied positionally.

Before, every event embedded the unexported subjectEvent, so risc.AccountDisabled{Subject: sub} would not compile (the subject is a promoted field, not a direct one). The only path was var e …; e.Subject = sub, which turns "forgot the subject" into a runtime AddTo failure instead of a compile error. A downstream consumer hit exactly this and fell back to hand-rolling the SET as raw JSON, leaving the typed producer path untested from the consumer side.

Design

• One NewX(subject) per non-deprecated event type; the required subject is positional, so it can't be omitted at the call site.
• NewCredentialCompromise(subject, credentialType) — its second required field is positional too.
• No constructor for the deprecated sessions-revoked event (the profile steers emitters to the CAEP session-revoked event).
• Optional members (Reason, NewValue, the credential-compromise reasons/timestamp) stay exported fields set on the returned value — no functional-options layer for already-exported fields.
• Considered and rejected: exporting the embedded struct as Base. It keeps the "remember to set Subject" footgun these constructors exist to remove.

Scope

• No wire-shape or decode-path change.
• Construction stays lenient (Postel's law): constructors don't validate subject format; identifier-changed/-recycled keep their email-or-phone requirement enforced at the AddTo/Validate marshal boundary.

Tests / docs

• Consumer-side round-trip test over every constructor (construct → AddTo → encode SET → secevent.Parse → Events.Typed yields a wire-equal event), plus a coverage guard that fails if a new event type ships without a constructor or if one is ever added for the deprecated sessions-revoked.
• ExampleAddTo and the README now show the constructor instead of the var+assign dance.
• Second commit corrects a pre-existing inaccuracy in the Example godoc (it described a blank import while the example uses a named one).

go test ./..., go vet, gofmt -l, and golangci-lint run all pass clean.

🤖 Generated with Claude Code