feat(scripts): --unread-report decomposes NOT read: per document, checksummed (#10874)

`check:published-readme-exports` printed its blind spot as two whole-repo
scalars and nothing else. They stop the green line reading as coverage (#9870)
— what they cannot answer is the question every per-document hand read starts
from: which document holds how many, and which sites are they? Answering it
meant re-implementing `analyzeDocument`'s `readable` derivation and
`countUnreadCalls`' body outside this file, which is the re-derivation this
file's header refuses for `publishedDocs`, failing the same way: a hand read
whose population silently disagrees with the gate's produces a defect count
with the wrong denominator, and nothing anywhere goes red.

`--unread-report` prints what the run already computed, per document.

- `unreadCallSites` returns the sites; `countUnreadCalls` is now a CARDINALITY
  VIEW over it rather than a second walk, so the scalar and the rows cannot
  disagree about what an unread site is.
- One statement in `analyzeDocument` produces the row and both scalars from the
  same object; `newMeasured()` defines the accumulator once, for the run and
  the self-test alike.
- The rows are re-added and compared with the scalars before printing. On a
  mismatch the rows are WITHHELD and a refusal is printed instead: a breakdown
  that disagrees with the total above it is worse than no breakdown, because it
  lends the gate's authority to a population the gate did not measure.
- The report header names the neighbouring whole-repo scalars as having no
  per-document share, and every row spells both numbers `unread …`. That is the
  fix for the invitation: this card was filed after `derivedReceivers` —
  printed one line above `NOT read:` — was quoted as one document's site count.

⛔ Visibility, not a verdict: no finding, no verdict and no exit code changes,
and the CI invocation does not pass the flag. Measured, not asserted: without
the flag this script's stdout, stderr and exit code are byte-identical to
origin/main's on both a green and a red fixture tree.

The self-test pins the checksum rather than trusting it — rows from the
production path, four separate drifts (a row grown, either scalar moved, a
whole row lost), each of which must refuse and withhold the breakdown.

Part of #10815


Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang