[floriankraemer]

Summary

• Public SPI in report.spi: CognitiveReporter, ChurnReporter and immutable input records, mapped from the domain so no internal classes are exposed.
• customReporters.{cognitive,churn}.<key>: {class, jar} is now applied. The jar is resolved against the directory of the config file and loaded with a URLClassLoader whose parent is the application loader. The class needs a public no-argument constructor.
• -r <key> resolves built-in types first. A custom key that equals a built-in type name (any case, same command) is a config error at load. Invalid-type messages and the option help list the custom keys.
• Only the requested reporter is loaded, before the analysis starts, so a broken reporter fails fast with a clear message.
• New docs/Custom-Reporters.md; the "not yet applied" note is gone.

Test plan

• Fixture reporter jars are compiled and jarred during the tests (javax.tools + java.util.jar).
• Loader: success, jar missing, class missing, wrong interface, constructor throws (with and without message), no public no-arg constructor, abstract class, static initializer failure, relative jar path, class path class.
• E2E via the CLI for analyse and churn: success, errors, key collisions, help, listing of custom keys, reporter failure writes no file.
• ./mvnw -B verify: green. JaCoCo 97.2% line, 95.2% branch. PIT 99% (886/887), report.* added to the targets.