feat(scan): balance action coverage within finite budgets

[datzle123]

What changed

• add deterministic coverage-balanced-v1 action scheduling for finite scan budgets
• represent more routes, action kinds, intents, and activation paths instead of taking controls in discovery order
• place known policy/environment denials after runnable actions while preserving destructive/logout ordering
• expose additive selection telemetry in scan.json and the HTML report
• fix report arrow/separator mojibake

Evidence

• pnpm check: 140 passed, 2 expected service-dependent skips
• pnpm audit --audit-level high: no known vulnerabilities
• pnpm smoke: passed, including a real three-route/three-action budget control
• pnpm pack: passed
• installed-tarball package smoke: passed

Release status

This is intentionally a draft release candidate. The behavior fingerprint changed from released 68d4a8cb… to candidate f3f65840…; existing real-project evidence remains correctly bound to v1.3.3 and must be rerun before Phase I can be merged/released with hosted 15/15 qualification.