ci: gate native backend coverage

[quinnbot-ai]

Summary

• Add a dedicated native-backend CI family and job so provisionable native runtime paths cannot silently disappear from coverage.
• Provision the exact Zellij 0.44.0 Linux build from its official release asset with GitHub-published SHA-256 verification.
• Emit typed unavailable evidence for cmux and Orca on runners that cannot provide those macOS-only backends.
• Keep native-backend coverage separate from portable and real-Herdr lanes, with declarative ownership checks and updated verification documentation.

Validation

• Real Linux x86_64 installer run: zellij 0.44.0
• GIT_CONFIG_GLOBAL=/dev/null bin/fm-test-run.sh tests/fm-test-run.test.sh
• bin/fm-lint.sh
• bin/fm-doc-audience-check.sh
• bin/fm-test-run.sh --check-coverage
• git diff --check origin/main...HEAD

The local changed-scope run had one red Herdr presentation concurrent-recovery assertion. The same isolated test failed identically on a pristine detached origin/main checkout in the same active-Herdr environment, so it is recorded as pre-existing baseline evidence rather than attributed to this branch. All task-owned gates above are green.

Delivery note

This PR was created manually against quinnbot-ai/firstmate because the worker process inherited a credential-wrapper depth marker and the wrapper correctly refused recursive invocation. The branch push and this parent-home PR creation both used the canonical fork target; nothing was submitted upstream.