Close shell policy coverage states

[Aaronontheweb]

Summary

• replace the redundant coverage-kind, reason, and scope tuple with one closed internal source
• bind validated actor evidence to the exact projected candidate snapshot
• remove derived path-domain and path-base tags already represented by typed domains and structural views
• preserve every approval outcome, trace row, path boundary, and durable contract

This slice removes 145 production lines and 36 test lines. The cumulative changed footprint is 8,520 production lines and 521 control-flow lines; the complete reduction gate remains open.

Validation

• focused policy, evidence, and matrix tests: 492 passed
• full Actors suite before patch-identical rebase: 3,438 passed, 1 expected Windows-only skip
• strict OpenSpec validation
• copyright header verification
• git diff check
• Slopwatch: only the existing unrelated PowerShellHostProbeTests timeout warning
• range-diff confirms exact patch identity after rebasing onto PR Inline shell policy stages #1958