fix: declare reportlab dependency

[steezkelly]

Summary

Partially addresses #33 M4 by declaring the PDF report generator dependency:

• adds reportlab>=4.0 to project dependencies
• adds a regression test that reportlab is declared when generate_report.py imports it
• adds an import regression test for generate_report.py after project install

Root cause

generate_report.py imports reportlab at module import time, but pyproject.toml did not declare reportlab. A fresh pip install -e '.[dev]' left the report generator broken with ModuleNotFoundError: No module named 'reportlab'.

Opposite-perspective review notes

I checked the tradeoff explicitly:

• Minimal fix: declare reportlab so the existing root-level report script imports and runs after normal project install.
• Alternative: make a [reports] optional extra and lazy-import reportlab. That would reduce default install footprint, but it would still leave the current report script unavailable after the documented dev install unless users know to install an extra.
• Since the audit finding is specifically "reportlab Not in Dependencies" and the repo already includes a generated PDF report artifact, the direct dependency is the least surprising fix.

Test Plan

• RED first: pytest tests/test_generate_report.py -q failed because reportlab was absent from pyproject.toml and unavailable in a fresh dev install
• python -m pip install -e '.[dev]'
• pytest tests/test_generate_report.py -q
• pytest -q
• runtime probe: generate_report.build_report('/tmp/hae-report-probe.pdf') created a non-empty PDF
• static added-line security scan
• git diff --check

Result: 141 passed, 11 warnings (DSPy deprecation warnings only).

Partially addresses #33 (M4: reportlab missing dependency).

[steezkelly]

Closing this split PR in favor of consolidated PR #67. Local integration found review/merge overhead across the stack (notably #61/#64 overlap in evolution/skills/evolve_skill.py), and #67 preserves the combined local test evidence: targeted stack tests 21 passed; full suite 160 passed; GitHub checks were absent on the split PRs. Review #67 instead.