Unify Pitot adapter verification under one supervisor

[bigboateng]

What changed

• add one canonical manifest for all built-in Pitot adapters and platform runners
• add a supervisor that enforces registry equality, scripts, workflow inputs, generated README status, and the complete 18-cell matrix
• replace five per-agent workflow controllers with one stable Pitot E2E workflow
• make the result writer and sticky reporter consume the supervised inventory instead of independent allowlists
• fail missing artifacts rather than silently omitting an adapter
• replace per-agent badges with one overall workflow badge and generated supervised-agent list

Why

Kimi demonstrated a boundary gap: a supported adapter could pass source tests while remaining absent from GitHub Actions, the PR report, and README status. The old system maintained separate allowlists with no invariant joining them.

The new supervisor requires the set of built-in adapters to equal the set receiving scripts, Ubuntu/macOS/Windows execution, report rows, and public visibility.

Trust boundary

The privileged workflow_run reporter continues executing from main. The PR workflow uploads a bounded, strictly validated data-only adapter inventory, allowing future adapters to appear in their first PR report without executing untrusted PR code.

Verification

• python3 labs/15-pitot/scripts/pitot_adapter_supervisor.py check
• 33 Python supervisor, reporting, and projection tests
• GOWORK=off go test ./...
• wind-tunnel tests
• Kimi subprocess verification
• generated public-surface and release-note checks
• sensor import-boundary check
• workflow YAML parsing

Rollout note

This is the one-time bootstrap of the stable unified workflow and reporter trigger. The new matrix runs on this PR, while the new workflow_run reporter becomes the default-branch reporter after merge. Future adapter PRs then receive their report row on the first run.