V2-S3/S4: Risk workflow engine with assignment, residual, acceptance and effectiveness

- Add RiskStatus domain enum with full state machine + transitions + labels
- Add migration: risk_assessments gains parent_id, workflow_status, assigned_to/at,
  accepted_at/by, review_date, closed_at/by; new risk_assignments, risk_acceptances,
  mitigation_effectiveness tables
- RiskAssessment model: new fillable/casts and parent/children/assignedTo/acceptedBy/
  assignments/acceptances relations
- Add RiskAssignment, RiskAcceptance, MitigationEffectiveness models (explicit table
  name for mitigation_effectiveness)
- Add RiskWorkflowService: transition (validated), assign (Safety Office -> Risk Owner),
  recordResidual (separate row + parent_id lineage), accept (band decision + rejected
  returns to owner), verifyEffectiveness (drives state), close (closure gate)
- RiskAssessmentController: show loads workflow statuses/transitions; new assign,
  recordResidual, accept, verifyEffectiveness, close actions
- Add routes with risk.assign/risk.approve/risk.close permission middleware
- Add 5 Pest tests: assignment, residual lineage, rejected acceptance routing,
  closure gate blocking, ineffective mitigation state
