Windows governed gate: report phase coverage and diff full rows #2212

Follow-up from Grok's review of #1804. These three changes harden the gating check after the hosted Windows governed run (scripts/ci/check_windows_governed_safety.py):

1. Report coverage without gating on it. Write a one-line $GITHUB_STEP_SUMMARY and a JSON field in the kept artifact. Include the phases reached, each phase's outcome and halt reason (for example approved: HALTED_BEFORE_EFFECT form_changed_after_approval), and whether the held and resumed phases ran. Right now Desktop approval: form-unchanged digest differs between reads of an unchanged window #2189 stops the approved phase, so the hold/no-write and resume-approval invariants never run on hosted CI. This makes that gap visible. Do not gate on halts: a fail-closed false stop must not turn CI red.
2. Diff full rows. Compare every column (first, last, dob, note) and the set of row ids against the seed, so a wrong-field write or a deleted row fails the check.
3. Say when no phase ran. When phases is empty, print "no phase ran" instead of "no unsafe write".

Refs #1804, #2189