Report build-time UES binding coverage without changing enforcement

[Pigbibi]

Summary

• Add optional, fixed-schema build-time coverage reporting: verified, mismatch, not_covered, uncomputable, or error; partial coverage is never reported as fully verified.
• Retain existing guard exit codes, the 300-second Docker probe timeout, and build/guard/push/deploy ordering. Missing revision bindings remain non-blocking.
• Sanitize console/report output using ordinal aliases, aggregate counts, and validated revision SHAs. Exclude target names, account/release identifiers, raw runtime configuration and probe stderr.
• Render only allowlisted report fields in an optional job-summary step; summary failures cannot bypass downstream validation. Build-time evidence does not attest the live deployed revision.

Verification

• Full local suite: 1323 passed, 5 skipped.
• Ruff, uv lock --check, Cloud Run startup validator, QPK pin consistency and shell workflow regression passed.
• actionlint passed for all workflows (shellcheck integration disabled).
• Synthetic Docker subprocess tests cover stamp/direct_url agreement, mismatch, missing metadata, nonzero exits and timeout; no live deployment/broker calls.
• Independent review completed; optional summary-step failure handling corrected and reverified.

Draft only. No deployment workflows dispatched, production settings/secrets/trading behavior changed, or merge performed.