#3486 refactor(coverage): drop the test-only fallow seam and isolate the suite

Summary

Removes the fallowBin parameter from check:coverage-crap's run(): it existed only so run.test.ts could swap in a fallow reporting a chosen finding, which docs/agents/testing.md forbids, and it was not needed — real fallow emits every report those cases asked for once the fixture is built to the shape it scores. Part of #3414.

Three cases now run on real fallow: the gap-beats-a-finding case edits the function that really scores 56 and then loses lcov; unmeasured_touched appends a complex function to a mapped file so the map predates it; the unscoped listing adds a complex scripts/tool.ts, outside both coverage roots, listed without blocking. --diff-file scoping is proven without a spy — the untouched-file case holds src/debt.ts at CRAP 42 and still exits 0, which only a diff-filtered fallow does, and the written diff names this change's file only.

The suite inherited GITHUB_ACTIONS and GITHUB_STEP_SUMMARY from the job running it, so fixture verdicts landed in the real step summary; both are cleared per case and restored. The stream capture now restores the descriptor it replaced rather than shadowing Duplex.prototype's write. CONTRIBUTING gains that this gate has no coverage-waiver label, and what a deletion charges — the boundary #3492 pins.

Validation

• SHA 678beada6 on origin/main: 56 tests pass; check:affected --base origin/main --run green under the gate lock; format, lint, tsc --strict clean (the run.test.ts:88 error pre-exists).
• The three shapes were probed against raw fallow health first. Net -74 lines; every replaced assertion names a score real fallow produced.