Problem

Similar to code-trace-index.json (#25), hazard-model.json is regenerated by pipeline hooks, silently reverting user edits. When a user improves the detection score (e.g., from 8 to 4 after adding formalism coverage), the next pipeline run resets it.

Reproduction

1. Hazard HAZARD-IDLE-QUORUM_START has detection: 8, rpn: 320 (critical)
2. User adds test recipe + formal model coverage
3. User updates detection: 4, rpn: 160 with justification
4. Next hazard-model.cjs run regenerates the file from trace data, resetting to detection: 8

Expected Behavior

• Detection score overrides should be user-owned and preserved across regeneration
• Option A: Separate hazard-overrides.json that merges with generated data
• Option B: Mark fields as "user_override": true so regeneration skips them
• The detection_justification field I added was also lost

Impact

Users cannot improve their hazard model's detection scores. The FMEA becomes a read-only artifact that doesn't reflect actual mitigation progress.