main: read the headless report's stance through one seam

[ghostpsalm]

Closes #19

print_linux_report (the --no-ui path, which headless --review also uses) read the default-inbound
stance itself and printed it in the same breath. No test executed that line, so deleting it would have
left the gate green while every headless report silently lost the verdict that tells a reader whether a
listening socket with no rule is exposed. This is the second site of the defect PR #18 closed inside
linux::bridge.

The whole report body now renders into a String via linux_report_text(backend, &Report, &Sources),
reading the stance through the Sources/read_from seam PR #18 added. print_linux_report keeps its
signature and is one print! line. Rendering the whole report rather than just the stance line is
deliberate: a pure stance_line() helper would still have let the call be deleted with the gate green,
which is the actual defect.

Verified

• local ./scripts/gate.sh — green; 231 passed; 0 failed (was 229)
• The guard works, by mutation. Replacing the stance read with a constant None fails
  the_headless_report_reads_the_stance_through_the_supplied_sources:
  "Unmatched inbound: could not be determined on this host" where
  "blocked — ufw's DEFAULT_INPUT_POLICY is DROP" was expected. Before this change the same deletion
  passed.
• Output is byte-identical. seraph extracted all 18 string literals from the old
  print_linux_report and the new linux_report_text — identical text, identical order, 15 println!
  → 15 writeln!, and print! pairs with writeln!'s trailing newline. breaker independently
  reconstructed and byte-compared four report shapes (empty; firewalld with the instrumentation line,
  idle rows, a note and two unmeasurable entries; None-only hits with an embedded newline in the note;
  negative and i64::MAX hits against the {:>12} width) — identical 4/4.
• seraph: PASS on every check.
• Authorship: an architect planned it, an oracle wrote both tests, a separate builder implemented and was
  forbidden from touching an assertion. Recorded in
  factory/runs/20260910-001337-no-ui-stance.json.

NOT verified

• breaker returned defect-found, for an adjacent defect this PR does not fix: src/main.rs:789
print_text_report open-codes its zero-hit filter as is_enabled() && total_hits() == 0, so on
  Windows --no-ui the synthetic default-policy row and zero-hit WFP pseudo-filters print as disable
  candidates. ui.rs:84 is_zero_hit() is the existing guard — hits_known && is_editable() && total_hits() == 0 — and main.rs:789 is the only site that does not use it. Filed as The headless Windows report lists the default-policy row as a disable candidate #21 and
  updated with that diagnosis. Deferred rather than fixed: it is the Windows path, nothing tests
  print_text_report at all, and doing it properly needs its own seam.
• The new tests cover one report shape — one ufw row, note: None, unmeasurable: [], no idle rows.
  Deleting the Collection: opt-in… line, the idle block, the note block or the unmeasurable block
  leaves the gate green. The stance is guarded; those sections are not.
• The Sources::system() line in each entry point is executed only by a real run. Declared irreducible
  in the plan — pinning it would need a test that reads /etc/default/ufw, the exact host-dependence
  this work removes — and both sites now carry a comment saying so.
• The oracle noted its independence is weaker here than on a fresh feature: this is a refactor, so it
  could read the existing code to derive the expected text. seraph judged that immaterial, since
  byte-identical output is the spec and the mutation test discriminates.
• Beyond the brief: linux::default_policy::read was deleted once its last caller went, because
  -D warnings makes dead code a hard error. git grep across the whole tree shows no remaining
  reference; its doc prose was folded into read_from.
• Pre-existing and out of scope, noted by breaker: read_from's ufw walk stops at the first readable
  file, so a readable-but-keyless /etc/default/ufw never falls through to /etc/ufw/ufw.conf. That
  semantic was deliberately preserved from before PR linux/bridge: inject the default-inbound stance into to_result #18. It fails to unknown, never to a deny.
• The Deno receiver leg is skipped locally (Deno absent on this host); CI installs it.