feat(qa): support complete nested inventory and manual coverage

[pathscale]

A surface marker can stay narrow for outcome polling while an optional inventory_root defines the complete application-owned control tree. Missing or ambiguous roots fail inventory instead of silently reducing coverage.

Surfaces behind nested navigation can declare an ordered via path, such as Components → Surfaces before Complete Coverage. The runner drives that path initially and after root recovery, then requires the destination marker.

Hosted QA now honors profile-declared manual controls during its baseline coverage check. These controls remain visible in strict inventory and its manual release worklist, but no longer make a fully reconciled behavior suite return failure merely because native automation intentionally excludes an external action.

Validation on 310c895:

• cargo fmt --all --check
• cargo test -p ps-qa: 163/163 unit, 2/2 CLI integration, 1 host-dependent test ignored
• release build passes
• js.software nested inventory: 353/353, including the 164-control Complete Coverage lab, zero identity/outcome gaps
• Worktables hosted QA: 192/192, exit 0, with its 32 declared external/manual controls excluded from false uncovered failures
• Worktables strict inventory/reconcile: 98/98, zero gaps