[ci] Require execution parity before planning

[joshlf]

The typed command model helps only if every caller checks it before a
plan can escape. Run its full legacy-parity proof while constructing
CiInputs, after policy, inventory, workflow, and baselines are trusted.

This makes validation all-or-nothing. New planners and local commands
cannot omit the execution audit or consume a model which has drifted
from independently captured behavior.

Tests: cargo test -p zc --all-targets --offline

Authored by an agent, posting via joshlf's account

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (Gqs4rhblhbsqga3glvc6tfjnakpdspo3b@e53b901). Learn more about missing BASE report.

Additional details and impacted files

@@                         Coverage Diff                          @@
##             Gqs4rhblhbsqga3glvc6tfjnakpdspo3b    #3588   +/-   ##
====================================================================
  Coverage                                     ?   91.85%           
====================================================================
  Files                                        ?       20           
  Lines                                        ?     6093           
  Branches                                     ?        0           
====================================================================
  Hits                                         ?     5597           
  Misses                                       ?      496           
  Partials                                     ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[joshlf]

Authored by an agent, posting via joshlf's account

GHerrit's partial metadata sync left this PR targeting a later stack branch, so GitHub closed it with an empty diff and would not permit reopening it. The same managed head commit now continues as #3598, targeting its correct immediate parent.