refactor(reir): factor fact-building helpers (behavior-preserving)

Introduce a private rsscript_evidence(kind) base constructor that fills the
cloud/runtime Evidence fields (event_id, time, event_name, principal,
account, policy_arn, statement_index, action) that RSScript evidence never
sets, plus the kind. The 13 Evidence-literal builders now use struct update
syntax to specify only the fields they actually populate, removing ~120
lines of repeated None boilerplate. Struct update produces byte-identical
values, so emitted REIR facts/JSON/hashes are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang