feat: add fleet run-ledger reconcile gate

[joshua-temple]

Problem

A scenario suite only verifies the runs it remembers to wait on, so a secondary run it causes (a PR-close hotfix Finalize, a seed-PR preview, an incidental push-orchestrate) can fail while the suite stays green. A coverage audit found exactly this in 3env, 2env, and primary.

Fix

A shared run-ledger reconcile gate that makes hard-100% coverage a structural invariant:

• register-run composite action records every gated run's id + expected conclusion into a ledger (workspace file for single-job suites, uploaded artifact for multi-job).
• fleet-reconcile reusable workflow enumerates every run the repo produced since the scenario window opened and fails if any is unaccounted for.
• The decision core lives in internal/fleetreconcile and is unit-tested against synthetic run lists, so the guarantee (an unregistered failing run reds the gate) is proven, not asserted. Cancelled runs are excused only when provably superseded within the same lane by a later registered run; a failure is never excused; the gate excludes its own run and out-of-scope workflows.

Verification

go build/test ./..., golangci-lint, and actionlint on the new YAML all clean. Reconcile table tests cover pass, unregistered-failure-fails, expected-negatives (both directions), superseded-cancel, and self/scope exclusion. Fleet infra only; no generated-workflow or schema change.