[cruiseliner]

Stacked on #7 (base: feature/calendars-holidays-risk). Review and merge #7 first; this PR will then retarget to main.

v0.8.0

• Risk events (risk --risks raid.csv: id, name, probability, min/likely/max impact days, linked task rows). A common-cause event adds one sampled impact to every linked task in the same run. The report shows each event's hit rate and mean finish impact.
• Uncertainty classes: an uncertainty CSV column (labor, equipment, design, vendor, permit, weather, fixed), with --class name=o,p overrides. O/P columns still win. The built-in factors are documented as planning defaults to calibrate, not as statistics.
• Sensitivity: Pearson correlation of each task's duration with the finish, shown as a tornado list in the text output and as sensitivity in JSON.
• Progress updates: --progress progress.csv --status-date D on from-csv, cpm and risk.
  • Columns: actual start/finish, remaining days, % complete.
  • Remaining work is scheduled after the status date.
  • The XML carries actuals, % complete and the status date.
  • Imported .mpp/.xer files bring their own progress and status date.
• Leveling within float: from-csv --level / cpm --level, a serial leveler (1 unit per resource). Delayed tasks get an SNET constraint and a note; conflicts it can't resolve are reported.
• DCMA: check --exclude-endpoints (Primavera P6 support (XER + P6 XML), v0.2.0 #1 ignores the start/finish milestones) and check --thresholds key=value,….
• XER writer: not in this PR, documented as next on the roadmap.

Tests

• fmt, clippy -D warnings and cargo test all pass: 38 unit, 18 cli, 8 p6, 14 reports and 1 doc test.
• risk over 783 corpus files: 582 OK, 0 panics. The 201 errors are expected: 197 have no tasks, 3 are password-protected and 1 needs the de locale.

Known gaps

• No general correlation matrix, only common-cause events.
• The leveler is not Project's or P6's leveling (no partial units, splitting or priorities).
• risk ignores --level.
• Progress uses date-granular actuals.