fix: harden truth and coverage gates

[xiaojiou176]

Summary

• harden tests_gate fail-closed handling and add regression coverage for blank/trivial/non-dict gate paths
• fix ControlPlaneReadService runtime/api-module loading so read-model tests and runtime helpers align
• add benchmark gate entrypoints/docs/env registry updates and route repo/dashboard/desktop coverage artifacts into governed .runtime-cache paths
• stop repo coverage / desktop playwright helper runs from leaking .coverage, .hypothesis, app-local coverage/, and legacy .runtime-cache/temp residue

Verification

• npm run ci
• npm run truth:triage (repo-side green; external truth red only on ci-core-image and ui-audit-playwright Docker unavailability)
• npm run coverage:repo
• bash scripts/run_orchestrator_pytest.sh apps/orchestrator/tests/test_control_plane_read_service.py -q
• bash scripts/run_orchestrator_pytest.sh apps/orchestrator/tests/test_repo_coverage_gate.py -q
• bash scripts/run_orchestrator_pytest.sh apps/orchestrator/tests/test_repo_coverage_gate.py apps/orchestrator/tests/test_tests_gate_extended.py apps/orchestrator/tests/test_bench_e2e_speed_gate.py apps/orchestrator/tests/test_mcp_queue_pilot_server_branches.py -q
• dashboard coverage smoke with CORTEXPILOT_DASHBOARD_COVERAGE_DIR=$PWD/.runtime-cache/test_output/repo_coverage/dashboard-smoke
• desktop coverage smoke with CORTEXPILOT_DESKTOP_COVERAGE_DIR=$PWD/.runtime-cache/test_output/repo_coverage/desktop-smoke

Notes

• upstream smoke receipts now pass for provider-runtime-path and pm-chat-real-e2e
• ci-core-image and ui-audit-playwright still fail with Docker daemon Connection refused / exit 125, so external truth remains platform-limited rather than repo-owned