[HKcode22]

Final technical Gate5 measurement, not an additional provider prerequisite

Binding owner direction: one-month lower-bias ML dataset, complete meaningful Gate5 by Nov4 evening PT if physically possible, stop re-investigating unavailable semantics, measure unknowns honestly. Real G5A PRE collection #372, signed API document provenance #373 and genuine capped POST reobservation #374 are already merged.

This PR adds a separate independent-only reader, not more source code:

• New GitHub-only read-only audit at Nov5 2026 05:12Z (Nov4 9:12pm Pacific), after frozen per-flight W=T_native+2h, with optional manually dispatched read-only fall-back. PR/push run only secretless unit checks, no provider or source write keys.
• Uses existing phase2g-paid/GATE05_AUTOMATION_DATABASE_URL independent reader, not the writer secret; strict REPEATABLE READ READ ONLY transaction. No new secrets or Replit commands.
• Counts actual V0076 three-horizon planned slots, unique irrevocable paid physical reservations, V0077 bound original bodies, source expiry and actual source availability by cutoff; independent genuine PRE snapshots committed before cutoff vs late/missing; confirmed operating-leg source denominator vs unresolved/codeshares.
• Reads the frozen G5A T+2h POST SQL to count observed schedule revisions ≥15min and less than 15min, unknown/censored if no lawful on-time source. Keeps actual-only runway and original target explicitly uncertified.
• Returns only aggregate counts and SHA, never source Content, flight identity or DB credentials. No paid API, no provider service, no database mutation.
• Returns HOLD for missing three-horizon source or bad counts. An eligible measured audit is NOT an automatic scientific Gate5 PASS: webhook inside/outside/unresolved, actual billing and missingness/rights/production event findings must still be reviewed.

Important distinction: workflow scheduled ≠ completed. We need the real Action logs and PostgreSQL result after Nov4 evening collection; this PR just ensures the correct independent audit is already on main.

Tests protect exact date/job/reader isolation, no API key or write URL, source original reservation/clock chain, true PRE cutoff, and authenticated physical denominator.