Import coverage files as runtime evidence #54

The easiest way to get runtime evidence: many projects already produce coverage data from their test suites or staging runs. Turn it into #53 events, with no sensor needed.

secfoo runtime import-coverage <file> --watchlist watchlist.json -o events.ndjson

• Python: a coverage.py JSON report (coverage json, ideally with --show-contexts). Coverage must have been collected with dependencies included (--source or [run] include), since site-packages are omitted by default. Explain this in the command's error message when no dependency files appear in the report.
• Node: V8 coverage directories (NODE_V8_COVERAGE=dir node app.js). These already include function-level ranges for node_modules.
• Count a watched symbol as a hit when its function range has a non-zero count. Fill app_functions_total/executed in the session line from the app's own files.
• Coverage has no stack traces, so leave entry_frame and stack_sample empty.

Done when: small committed fixture coverage files for both formats are tested end to end (import → ingest → evidence rows).