validate_records.py: check severity against the score's band #396

Nothing checks that a record's severity is the band its score falls in. CLAUDE.md hard rule 6 and the schema both say the two must agree; scripts/validate_records.py recomputes aars and the score and compares the top-level score, but never the label. A rescore that moved a score across a band edge could leave severity behind, and every consumer that gates on severity would read the old band. All 89 records agree today (checked on develop at 9af2038).

Proposal, one pull request: check_severity_band in scripts/validate_records.py, wired into record_errors, covering severity and aivss.aivss_severity where present, with tests and a CHANGELOG entry. No record, schema file or score changes.

This replaces the first version of this issue, whose other items moved: the scoring documents are now part of #395's resolution, and SECURITY.md is #397.