fix(reporting): isolate account facts ingress diagnostics

[Pigbibi]

Summary

• Keep account-facts publishing disabled by default; add an explicitly selected ingress-diagnostic mode to the existing heartbeat workflow.
• Isolate that mode from heartbeat, GCP/WIF, GCS reports, runtime-evidence publishing, brokers and daily digests.
• Send exactly one fixed empty JSON body to the existing account-facts endpoint with the existing protected token, a 15-second timeout, no redirects and no retries.
• Report only allowlisted HTTP categories/error codes; only HTTP 400 plus invalid_account_facts_history verifies authentication and rejection before storage. Other outcomes remain unverified/unknown.
• Preserve the existing live publisher identity guards and 15-minute freshness boundary.

Validation

• 29 targeted mock tests passed.
• actionlint and git diff --check passed.
• Independent incremental review passed.
• Synthetic receiver validation returned HTTP 400 / invalid_account_facts_history with zero KV writes and zero Durable Object accesses.

Operation scope

User explicitly approved publication/adoption of these three diagnostic files and one empty-body diagnostic execution. No broker sampling, real report replay, funds storage, credential update, Cloud Run deployment or Scheduler change is included. Historical publish_failed root cause remains unknown until further evidence; this diagnostic cannot establish actual funds sync success.