Census colour as TSV; newly-red is a lockstep identity join

[gunbai-bot]

Summary

• Durable instrument for the arrow-form accumulator-copy census: census_tsv_line_for_path returns a TSV String (not a wrapping exit code); newly_red_difference joins two arms at path identity.
• Newly red = scanned-suspect after and scanned-zero before. Unmeasured (not-established / timeout / OOM) is listed and is not red. A file already red on main is not newly red even if the count rose.
• Constructed-row witnesses in accumulator_copy_corpus_path_test.dag (no ingest). Consumer of the join is the two-arm census receipt.

The srv1 batch shell stays on origin/relay/arrow-census (not for merge). The census receipt (runs.tsv, join, newly-red set) attaches to #11315 as a comment when the live batch finishes.

Cherry-picked from 5f931fc onto current main after those commits were reset off #11315.

Test plan

• Constructed-row witnesses: newly-red / already-red-on-main / unmeasured-before / path-mismatch (same file as the existing coverage join, no ingest)
• Live srv1 batch 1 runs.tsv fed through newly_red_difference (in flight; not blocking this PR)