Recall coverage completion, progress, and privacy invariants

A detail response is complete only when its completion marker is non-zero; text alone cannot prove completion. Count zero-length coverage only for a complete detail item with length 0, because only that proves the source has no body. Only retained duplicate coverage keys prove no progress; undefined, oversized, unknown, or FIFO-evicted coverage resets the counter. Stop after the third consecutive proven no-progress result (>2). RecallCoverage is private in-process metadata: runRecallWithMetadata() may return it to callers, but rendered output and telemetry must never expose revisions, coverage keys, source identities, or related fields.