Add portable exact-run SCIM validation reports (depends on authentication)

[pranems]

Summary

Reporting-only follow-up, stacked on feature/auth-methods-20261016. Depends on AzureAD#170.

• Add sanitized portable JSON, Markdown, and optional ZIP reports.
• Preserve exact-run and child-run identity, version/hash provenance, timing, semantic results, readiness, and explicit evidence gaps.
• Add failure-focused collection, protected-payload accounting, checkpoint/resume, and offline finalization.
• Integrate unique startup folders and actual lifecycle events into the canonical agent.
• Preserve diagnostic status/error codes while redacting OAuth authorization codes.
• Preserve empty/singleton arrays in embedded JSON, recursively count protected repetition payloads, and redact textual OAuth codes inside embedded JSON.
• Add offline reporter regression coverage and focused reporting documentation.
• Advance bundle/parameter version from 14.0 to 15.0.

Strict separation

The delta against the authentication base contains exactly ten reporting/documentation/test/version paths. All seven runtime workflow definitions are byte-identical to the authentication baseline. The only parameter-template difference is LogicAppVersion.

Authentication declaration, AND policy, token transport/refresh, runtime secret protection, and functional test semantics are not changed here.

Verification

• 6,078 authentication/startup assertions passed.
• 341 checked-in offline reporter assertions passed, independently rerun after the fixes.
• 2 persisted-artifact checks and 73 structural/isolation/provenance/archive checks passed during the offline review.
• Before publishing the follow-up, the coordinator matched 10 reviewed source hashes, 5 evidence-artifact hashes, and all 7 workflow hashes.
• Structural checks covered versions, syntax, relative links, workflow identity, scope, and exclusion of private environment setup.
• The synthetic VERSION-14 reporter fixture is intentionally distinct from current source VERSION 15.

Limitations

Offline validation is not a version-15 live certification. Historical combined reports retain their actual source/executed versions and hashes, failures, and cleanup provenance. Complete evidence does not imply gallery readiness.

The reporting workstream does not operate the shared cloud endpoint while authentication owns its fresh validation.

Stacked review / upstream handoff

This draft is deliberately hosted in the contributor fork and targets its authentication branch, keeping the review reporting-only. GitHub cannot use a fork-only branch as an upstream base.

Authentication must land upstream first. Then update this branch safely onto the merged upstream baseline, rerun checks, open the reporting-only upstream PR, link it here, and close this fork review. Do not merge this draft merely to bypass the dependency, and do not publish a cumulative authentication-plus-reporting upstream diff.