docs(ci-coverage): define evidence contract; implementation unpublished

[rldyourmnd]

Documentation-only draft

This PR records the design and acceptance contract for read-only CI execution coverage. It does not implement or ship an evaluator, CLI, collector or repository enrollment.

A reusable evaluator and standalone inspector were implemented and tested locally, but the GitHub tool blocked the source publication. That write was not retried via another method. The local prototype is retained for independent review in the operator's handoff bundle; it is not code in this PR.

Contract

• Distinguish repository discovery, effective runner/workflow/cache eligibility and actual successful execution.
• Bind observations to immutable repository IDs, declared profiles, exact revisions, estate/engine commits and module-lock digest.
• Preserve missing, stale, future, incomplete and denied evidence rather than claiming all-private-repository coverage.
• Verify exact run/job/attempt/head relationships through authenticated collection; provenance locators alone are not attestations.
• Keep the inspector read-only and outside per-job scheduling. Do not broaden observer permissions or create a new mandatory CI gate.
• Reject empty-scope acceptance, identity ambiguity and duplicate/concatenated JSON.

Verification status

The unpublished local prototype passed six top-level stdlib-only Go tests with 36 named table subcases, plus decoder cases, under Go 1.23.2 with race detection; focused go vet passed. Those are local prototype results, not evidence that the source exists in this branch. Repository toolchain pins are unchanged.

Completion

Independently review the proposed contract and prototype, implement reviewed changes through an authorized development workflow, run pinned-toolchain CI against the actual committed code, and integrate complete paginated policy observations through the existing application/control-plane boundaries. Real private-repository job evidence remains required for every profile. No live coverage or fleet speed improvement is claimed here.