MVP: Push verdicts to Loki (or configured sink)

Parent: #74

### Scope
On every scan/validate decision, push structured log to Grafana Loki when `LOKI_URL` (or equivalent) is set; otherwise durable local/structured sink.

### Related
#20 (and schema from sibling MVP logging issue)

### DoD
- Config flag/URL
- Emit on CLI-driven validate completion + HITL resolve
- No-op / file fallback when Loki unset (dev-friendly)