[abrichr]

Closes #2131.

scaffold-verifier --probe-reads used to refuse a probed collection read whenever a write outside it would pass (an open collateral_unaudited miss). Now it first looks for a read that covers the whole save.

• Candidates: the sibling collections under the same prefix that the app itself read (path only, from its successful captured GETs), and the prefix root (GET <prefix> and GET <prefix>/).
• When the root is used: only if all of these hold:
  • it holds the written record, and every record the collection and each sibling returned;
  • it comes back as one unpaged response;
  • every captured write went under the prefix;
  • every top-level value is a list of objects or a scalar. An object value, such as a nested collection or an id-keyed map, refuses the root with the key named. The check fails closed on shape.
• What the check reads then: every top-level list, empty ones included, plus every list under a key that was not there when probed (records_other_lists). The save may add exactly one row to the saved record's list and none anywhere else. A reviewed list that disappears, or an object value that appears, makes the read unreadable (records_list_keys).
• Otherwise: the refusal stands, and its reason lists what was probed.
• Probe rules: GET only and local only. Probes drop any user and password from the URL, use no proxy and follow no redirects. Every probe is recorded in read_discovery.json (now also written when a probed read is used) and in the proof.
• App-specific code: none. check_engine_generality.py passes, and the generator guesses no route names.

Benchmark (fourth run, at ae4ecc7, 69 trials). The dated PROTOCOL.md notes were committed before the run, and the third run is kept as results-run3.json.

• MockLoan Z-net-probed stays refused, with the reason recorded: GET /api and GET /api/ return 404, and the app reads no sibling collection.
• MockMed Z-net-probed stays unavailable, because the app has no JSON read route.
• Every other arm matches the third run.
• The hand-written files as committed now match +complete, because RL environments: TRL, SkyRL and verl adapters #1784 added records_complete: true to them.

Tests. tests/test_read_discovery_cover.py has 24 cases. They cover:

• promotion;
• refusal: no root, a sibling only, a root missing a sibling's records, an unreadable sibling, a write outside the prefix;
• regression cases for an empty sibling list, a collection absent and then present, a nested collection, an id-keyed map, and an object that appears after promotion;
• no credentials, no redirects, no remote probes.

The record-check suites pass (2269 passed, 2 skipped), and ruff and mypy are clean.