Qualify readonly terminal reports from protected workflow revision

[Pigbibi]

Changes

• Allow the existing manual read to qualify the current protected workflow revision after its Runtime completes.
• Require attempt one, latest successful run, no active Runtime, selected application provenance and successful strategy/report steps.
• Keep the existing fixed legacy path and all broker/receipt protections.

Verification

• 57 targeted tests passed.
• Ruff, actionlint, compilation and diff checks passed.
• No trading workflow or production application change.