feat(compliance): add get_compliance_reports_by_batch tool and surface batchId

[AutomateIP]

Summary

Adds a new read-only tool get_compliance_reports_by_batch(ctx, batch_id) and
fixes a bug where run_compliance_plan silently discarded the platform's
batchId. The two changes are coupled: the new tool needs a batch ID, which
was previously being dropped before the caller could ever see it.

Changes

• run_compliance_plan now surfaces batchId: str | None (optional; graceful
  degradation over strict validation, per explicit design decision).
• New tool get_compliance_reports_by_batch(ctx, batch_id: str), annotated
  read_only=True, idempotent=True, open_world=False.
• New service method on the configuration_manager platform service.
• New response models validated field-by-field against a real platform
  OpenAPI spec, using the established wrapper-model pattern (per fix: route get_templates through GetTemplatesResponse RootModel to remove startup output_schema warning #405/feat: add trigger_automation tool and get_automations unified view #356/fix: handle union return types in tool output schema generation #361).
• Tests: model, service, and tool coverage for both changes, incl. a regression
  test that fails without the batchId pass-through.

Testing

• make ci passes clean (2858 tests).
• Integration-tested against a real live Itential Platform: ran a real
  compliance plan ("NERC-CIP Cisco IOS Compliance Plan"), confirmed the
  response now includes a populated batchId, then called
  get_compliance_reports_by_batch with that real batch ID and received 4 real
  per-device compliance report records with correct schema. No regression on
  describe_compliance_report or get_compliance_plans.

Known limitations

• The batch-reports endpoint returns an empty list both when a batch has zero
  matching devices and when the batch ID is unknown/nonexistent. Callers cannot
  currently distinguish these two cases from the response alone.

Related Issues

Roadmap: 0.15.0 Tier C #10.