Self-documenting Makefile and read-only query CLI

`make` now lists targets grouped by use with examples. New read-only
tools/risk.py backs list/all/show/waits/escalations/policies; checked accepts
ID/OUTCOME/NOTE (ARGS still works). Adds CLI tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89

tests/test_risk_cli.py

@@ -0,0 +1,44 @@
+import contextlib
+import io
+import pathlib
+import sys
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "tools"))
+import register_lib as lib
+import risk
+
+LIVE = {"id": "RISK-F-0002", "status": "open", "severity": "medium", "fix_owner": "b",
+        "title": "live", "_path": lib.REPO / "findings" / "x.md",
+        "waiting_on": [{"who": "b", "what": "answer", "default_at": "2026-10-06"}]}
+FIXED = {"id": "RISK-F-0001", "status": "fixed", "severity": "high", "fix_owner": "a",
+         "title": "done", "_path": lib.REPO / "findings" / "y.md"}
+
+
+class RiskCliTests(unittest.TestCase):
+    def run_cli(self, *argv):
+        out = io.StringIO()
+        with patch.object(lib, "findings", return_value=[LIVE, FIXED]), \
+             patch.object(lib, "regulatory", return_value=[]), \
+             patch.object(lib, "workplans", return_value=[]), \
+             contextlib.redirect_stdout(out):
+            code = risk.main(list(argv))
+        return code, out.getvalue()
+
+    def test_list_hides_closed_unless_all(self):
+        self.assertNotIn("RISK-F-0001", self.run_cli("list")[1])
+        self.assertIn("RISK-F-0001", self.run_cli("list", "--all", "--severity", "high")[1])
+
+    def test_show_known_and_unknown(self):
+        code, out = self.run_cli("show", "RISK-F-0002")
+        self.assertEqual(code, 0)
+        self.assertIn("waiting on b until 2026-10-06", out)
+        self.assertEqual(self.run_cli("show", "RISK-F-9999")[0], 1)
+
+    def test_waits_ordered_by_deadline(self):
+        self.assertIn("2026-10-06  RISK-F-0002", self.run_cli("waits")[1])
+
+
+if __name__ == "__main__":
+    unittest.main()