coverage union: add the ca-pi/tools host cell (#521 follow-up)

[SUaDtL]

Follow-up to #521 / DECISION-0031, which established that a quoted coverage figure is the union across a tree's supported hosts, per tree.

The rule shipped in ca 2.10.2 and the union job shipped for plugins/ca/tools. plugins/ca-pi/tools is the other platform-forked tree — Windows supervisor and process-tree paths — so it is in scope for the rule but has no union job yet. tech-stack.md says so explicitly rather than implying coverage it does not have.

Why it was split rather than done together

The coverage-union job installs a dependency graph, and test_ci_impact.py derives an audited-graph rule: a job may skip the audit itself, but may not install a graph nothing audits. That attribution reads the job's working directory, so it only resolves when the directory is a literal path — a matrix.tree-templated one resolves to ., which nothing audits.

Adding audit steps to compensate is not the fix: a second contract pins the exact multiset of npm audit invocations across ci.yml and docs.yml (three production-durability gates, three dev-inclusive, one for site), and extra audits break it. Both contracts are right; satisfying them means a literal working directory, which means one job per tree.

So this is a mechanical duplication of the existing pair, not a design question.

Scope

• A coverage-union-pi matrix cell on [ubuntu-latest, windows-latest] with working-directory: plugins/ca-pi/tools, gated on needs.changes.outputs.ca-pi, emitting a vitest blob artifact.
• A coverage-union-pi-merge job downloading those blobs and running vitest --merge-reports.
• Both advisory — added to ci-passed.needs, never to required_results, and the sanctioned-advisory list in test_ci_impact.py extended to name them. DECISION-0031 weighed Available and made this explicitly non-blocking; a Windows runner flake (flaky: controller pid protocol times out in test_pi_process_tree.py on windows-latest #535 is live) must not block a merge on a figure no check consumes.
• tech-stack.md's per-tree table updated from "not yet — tracked in coverage union: add the ca-pi/tools host cell (#521 follow-up) #537" to the measured state.

Acceptance criteria

• AC-1: a ca-pi-touching PR produces a merged coverage figure for plugins/ca-pi/tools from both hosts.
• AC-2: the merge job reports how many hosts contributed, and says so when only one did — a partial figure must never read as the union.
• AC-3: both jobs are advisory: present in ci-passed.needs, absent from required_results, and named in the sanctioned-advisory assertion.
• AC-4: the audited-graph and exact-audit-inventory contracts in test_ci_impact.py both still pass, without adding an npm audit invocation.
• AC-5: tech-stack.md's per-tree table matches what CI actually computes.

Note

plugins/ca-sandbox/tools and site/ are deliberately NOT in scope: neither forks on platform, and a union of identical reports is the same report.