rewrite 2.0.0: real process — extract the algorithm into DMN

The 1.x package was a single ai.extract call wrapped in three BPMN
service tasks. No decision logic, no dmn cornerstone, no weights — the
risk/routing/validation algorithm lived invisibly in host code. There
was nothing for a runtime to actually execute.

2.0.0 makes it a real process:

- dmn cornerstone added with three decision tables:
  * assess-personal-data-risk  — PII regex signals -> risk level
  * gdpr-processing-route      — risk x centralisation -> CENTRAL/LOCAL,
                                  anonymisation, redaction level
  * human-validation-gate      — confidence thresholds + PII re-scan
                                  -> REJECTED/PENDING_REVIEW/APPROVED_AUTO
- BPMN expanded 3 -> 6 nodes (3 serviceTask + 3 businessRuleTask),
  with horizontal DI.
- Task ids, mappings, docs, manifest (dmn:true), uapf.yaml, lifecycle
  and eval-set updated; added a PII-bearing fixture.

Only the semantic extraction remains a model step. Risk classification,
GDPR routing and validation gating are now explicit ranked DMN rules —
inspectable, versioned, portable. Breaking change: structure + outputs.

tests/eval-set.json

@@ -1,24 +1,41 @@
 {
   "algorithm": "Process_SemanticDocumentAnalysis",
-  "package_version": "1.0.0",
+  "package_version": "2.0.0",
   "cases": [
     {
-      "id": "child-rights",
-      "input_fixture": "fixtures/child-rights-input.json",
-      "expected_facets": {
-        "mentions_child": true,
-        "vulnerable_group": true,
-        "humanValidationStatus": "PENDING"
+      "id": "pii-bearing-high-risk",
+      "input_fixture": "fixtures/pii-bearing-input.json",
+      "input_vars": {
+        "allowCentralization": false
+      },
+      "expect_decisions": {
+        "assess-personal-data-risk": {
+          "personalDataRisk": "HIGH"
+        },
+        "gdpr-processing-route": {
+          "processingRoute": "LOCAL",
+          "redactionLevel": "FULL"
+        }
       }
     },
     {
-      "id": "discrimination-disability",
+      "id": "no-pii-discrimination",
       "input_fixture": "fixtures/discrimination-input.json",
-      "expected_facets": {
-        "vulnerable_group": true,
-        "humanValidationStatus": "PENDING"
+      "input_vars": {
+        "allowCentralization": true
+      },
+      "expect_decisions": {
+        "assess-personal-data-risk": {
+          "personalDataRisk": "NONE"
+        },
+        "gdpr-processing-route": {
+          "processingRoute": "CENTRAL"
+        }
       }
     }
   ],
-  "success_criteria": { "min_pass_rate": 0.95, "max_p95_latency_ms": 15000 }
+  "success_criteria": {
+    "min_pass_rate": 0.95,
+    "max_p95_latency_ms": 20000
+  }
 }