Add report fragments and export manifest

tests/golden/export-manifest-shape.json

@@ -0,0 +1,17 @@
+{
+  "top_level_keys": [
+    "certification_boundary",
+    "counts",
+    "created_at",
+    "export_type",
+    "id",
+    "mapping_summary",
+    "policy_summary",
+    "report_fragments",
+    "run_id",
+    "schema_version",
+    "source_lock_ref",
+    "source_package_ref",
+    "summary"
+  ]
+}

tests/golden/sdk-fixture-report-fragment.md

@@ -0,0 +1,5 @@
+### SDK Fixture Summary
+
+- evidence items: 2
+- findings: 0
+- source lock: source-lock:sdk-fixture-assessment:sdk-fixture-target