fix(test): close the review findings on the single-owner lanes

Adversarial review (Codex + self) findings, each fixed fail-closed:

- Both required aggregate jobs ran on a bare `needs`, and a needs-only
  aggregate is SKIPPED when a dependency fails — which branch protection
  reads as passing. They now run under `if: always()` and fail unless every
  needed job succeeded.
- A failed `zig build install test-integration-bin` fell through to kcov
  measuring a stale binary; the build status is now fatal.
- The lifecycle proof's run marker proved it RAN, not that it PASSED — the
  binary exits 0 either way. Its tally is now parsed like the main suite's.
- Evidence provenance now also digests the lane recipes, the component
  reporter, the recorder, the union grader and the kcov invocation (path-
  normalised), plus the full floor set — an edit to how coverage is
  collected or judged refuses evidence collected the old way.
- verification_timing.py refuses negative or non-finite durations, unknown
  arms, and a zeroed --min-samples.
- Every job in the coverage workflow is pinned to the same image digest the
  unit producer already pinned; a retag can no longer change kcov or libc
  under an unchanged Zig version string.

The first full-sequence run on this machine also proved the tally gate in
anger: it refused to grade over `987 passed; 1 failed` when a <5.5s latency
assertion blew under kcov plus deliberate concurrent load.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>