feat(runtime): harden daily pipeline audit and verification

Tighten real-ingestion success rules, separate scheduled reports from historical rebuilds, and persist source-level runtime audit across daily pipeline runs.

Also add the Phase 5 CI workflow contract plus verification updates and supporting docs so the full uncommitted change set can be validated together.

cmd/server/main.go

@@ -253,6 +253,8 @@ func fetchLatestReport(ctx context.Context, db *sql.DB) (*latestReportResponse,
 		FROM daily_report
 		WHERE output_path IS NOT NULL
 		  AND output_path <> ''
+		  AND status = 'generated'
+		  AND COALESCE(is_official_daily, true) = true
 		ORDER BY report_date DESC, updated_at DESC
 		LIMIT 1
 	`).Scan(