Extract disabledResult and evidenceEval helpers to reduce boilerplate

Add two shared helpers to source.go and apply them across all sources:
- disabledResult(id, name) replaces the repeated inline SourceResult literal
- evidenceEval(r, severity) replaces the identical Evaluate body in 6 sources

checker/source.go

@@ -152,6 +152,20 @@ func Sources() []Source {
 	return out
 }
 
+// disabledResult returns the standard "source is disabled" sentinel slice.
+func disabledResult(id, name string) []SourceResult {
+	return []SourceResult{{SourceID: id, SourceName: name, Enabled: false}}
+}
+
+// evidenceEval is the common Evaluate body: listed when there is at least
+// one Evidence entry and no error.
+func evidenceEval(r SourceResult, severity string) (bool, string) {
+	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+		return true, severity
+	}
+	return false, ""
+}
+
 // EvaluateResult looks up the source that produced r from the registry
 // and delegates to its Evaluate method. Returns (false, "") when the
 // source is not found — a safe default that never promotes a stale