fix(conformance): classify report secret-scan failures

[BunsDev]

Report secret-scan rejections were incorrectly attributed to phase1.stage.evidence-authority.report.failed. Use the existing phase1.stage.evidence-authority.scan.failed boundary so protected-run diagnostics identify the failed operation.

Addresses the unresolved review in #140: #140 (comment). The producer byte count/digest, workflow authority, lock, and expected authority fixtures are refreshed together.

Validation:

• Reproduced the actual report scan boundary with a synthetic prohibited field: failed with report.failed before the patch, passes with scan.failed afterward.
• Producer conformance suite: 283 passed, 1 skipped.
• Lock suite: 91 passed, 1 skipped.
• Normal suite: 552 passed, 61 skipped, including documentation digest consistency.
• Lint, typecheck, and committed authority verification (all 25 files) passed.

Merge with an actual merge commit: the lock references behavior commit 667750af2ef5d2ea14ec4e825e1bd54a57e771f5, which must remain an ancestor. This diagnostic correction does not substitute for the downstream SDK validator rebind and protected matrix rerun.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.