Add protected read-only paused account facts preflight

[Pigbibi]

Changes

• Add a default-off, manual-only preflight on main for one protected paused target.
• Read the archived maintenance handover, validate the protected target binding and preserved file hashes, and inspect existing cloud permissions.
• Emit only fixed status categories, counts and permission booleans. Do not call the broker, alter traffic or Scheduler configuration, or publish balances.

Validation

• 69 relevant tests passed.
• Ruff, actionlint and diff checks passed.
• Independent review passed for the three changed files.

The real protected Runner preflight remains to be executed after merge. This change does not implement or claim acceptance of the complete balance-refresh operation.