fix(scoring): validate optional metadata and duplicate queue IDs

[ethanolivertroy]

Summary

A focused, dependent fix for #2 (risk-scoring-gaps-1-7). It keeps the scoring model intact while closing two contract gaps found during isolated review:

• rejects duplicate asset_id values at collection-assessment time, preventing the migration_work_queue from failing with a Rego function-output conflict;
• validates optional regulatory_category and dependent_asset_count values whenever supplied, so malformed enrichment cannot be silently accepted behind an explicit numeric deadline;
• adds the new calendar-anchored inventory fixture to the existing schema-validation command.

Regression coverage

• duplicate IDs produce structured invalid-inventory output and an empty work queue instead of an evaluation conflict;
• unsupported category plus fractional dependent count is rejected;
• the full OPA suite and all three documented inventory examples are exercised.

Validation

Executed in a disposable, network-blocked Modal CPU sandbox:

opa test -v policies/                 PASS: 59/59
opa check --strict policies/          PASS
check-jsonschema (3 examples)         PASS

This deliberately targets risk-scoring-gaps-1-7, rather than main, so it can be reviewed and merged as a small follow-up to #2.