Add offline UDP evidence summary reporting

[Adam-Ghanem]

Summary

• add netwatch_udp_report.py, a no-network CLI for summarizing previously exported UDP evidence
• accept NetWatch JSON envelopes, JSONL, and CSV with auto-detection or an explicit format
• emit aggregate-only JSON using the existing conservative UDP evidence summary semantics
• enforce a 5 MiB input cap and 10,000-record cap
• reject malformed CSV rows with extra columns instead of accepting ambiguous field mappings
• add focused parser, aggregation, validation, malformed-CSV, and limit regression tests

Why

JSONL and CSV exports intentionally do not carry the JSON run-summary envelope. Operators and SIEM/reporting pipelines need a bounded way to compute the same uncertainty-aware summary from stored exports without re-running probes or retaining payload material. This also supports safer offline analysis workflows.

Research basis

Nmap's UDP model keeps silence ambiguous (open|filtered) until service-aware evidence elicits a response. Zeek and Suricata emphasize structured, correlatable telemetry suitable for downstream pipelines, while Wireshark provides investigation views over already-collected evidence. This increment follows that pattern: analyze retained metadata offline rather than adding network activity.

Safety boundary

This CLI sends no packets, opens no sockets, and adds no scan targets, ports, probes, retries, privileges, or payload retention. Input processing is explicitly bounded.

Verification

The previous head passed formatting/import checks and Security CI but failed the Python lint/type-check stage. The CSV row boundary was tightened to preserve the strict dict[str, object] contract and reject overflow columns, with a regression test added. Local Git clone remains blocked in this runtime by DNS resolution for github.com, so repository-wide verification is delegated to GitHub CI.