SDK: enforce Detection.score_delta >= 0 at the schema boundary (add-only invariant)

[gterdem]

Summary

Detection.score_delta (firewatch-sdk/src/firewatch_sdk/models.py) is typed int with no lower bound. The add-only scoring invariant currently holds only by convention (rules pass positive literals) plus a downstream clamp (scoring.py merge_score floors at 0, caps boost at +30). Enforce it at the schema boundary so a future negative score_delta fails validation rather than relying on the clamp.

Acceptance criteria

• Detection.score_delta SHALL carry ge=0 (or equivalent) so a negative value is a validation error.
• Existing callers (all positive literals) SHALL be unaffected; gates green; golden byte-identical.

Origin: PR #86 security review (non-blocking note). Related: ADR-0015 (additive-only), scoring.py clamp.