perf(test): give the live daemon suite a single execution owner

make test-coverage-zig keeps the seven unit kcov components and executes no
live daemon binary; make test-integration runs agentsfleetd-integration-tests
once under kcov — the same execution yields the integration verdict and the
integration half of the coverage union — plus the isolated boot-to-drain
proof. Each producer records a provenance manifest (source digest, toolchain,
component-inventory digest, platform), and the new make test-coverage-grade
validates both fail-closed before grading the nine-component union with every
existing floor, required component, required root and denominator minimum
unchanged. The canonical sequence grades automatically on matched evidence;
mismatched evidence names the field, absent evidence is named, not punished;
a TEST_FILTER run records filtered evidence no floor will accept.

Continuous Integration (CI) consolidates the whole Zig coverage graph into
the test-integration workflow — two parallel producer jobs, one grade job
consuming their run-scoped artifacts, the kernel job, and the required
aggregate that needs them all — because artifact storage is run-scoped.
test.yml keeps the unit and package lanes; its 14.3-minute coverage job,
6m07 of which was the duplicate live suite, is gone. Both workflows drop the
docker socket mount their containers no longer need.

make/test-infra.mk splits the compose/ports/reset concern out of
make/test-integration.mk (length cap); scripts/check-kcov-components.sh is
the shared component-verdict reporter both producers call. Lane and workflow
guards re-pointed; scripts/check_zig_coverage_lanes_test.py drives both
recipes against a stubbed kcov and holds the one-owner rule, the evidence
rules, and the CI wiring.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>