feat(engine)!: SKIP stops outranking OK, coverage gets its own axis

A repo's `status` is now the worst JUDGED finding, and `SKIP` only when
nothing was judged. `SKIP` used to rank between `OK` and `WARN`, so one
un-runnable check spoke for every check that ran: 0 ERROR, 0 WARN and a
dozen OK headlined as "skipped". Five repos in org-ops census 05, `okr`
among them with the most OK in the org, reading as unread.

"`SKIP` is never a pass" survives in the half of the rule that carries
it — an unregistered repo, or an empty finding set, still says SKIP,
because there is nothing else to be worst of.

Fixing the status alone would have traded "clean repos look skipped" for
"skipped checks look clean". So `notChecked` rides beside it: in --json,
and as a `· N not checked` qualifier on the summary line. Absent means an
older engine, not zero.

Measured across all 21 local clones from ONE saved sweep, so before and
after come from the same findings rather than two sweeps of a moving org:
343 findings before, 343 after. 8 repos moved, every one SKIP -> OK.
1 ERROR and 3 WARN before, 1 ERROR and 3 WARN after — the counts that
decide whether a repo needs work did not move.

BREAKING: consumers reading `.status` see a changed value domain.

147 -> 154 tests.

CLAUDE.md

@@ -28,7 +28,17 @@ would recreate, in data, exactly the drift this plugin exists to remove.
   not belong here. It is measured where the org is enumerated.
 - **It records, it does not fix.** Findings first, remediation afterwards.
   Patching while measuring is how the inconsistency it detects was produced.
-- **`SKIP` is never a pass.** A check that could not run says so and names why.
+- **`SKIP` is never a pass — and never a severity either.** A check that could
+  not run says so and names why. But a skip is the ABSENCE of a verdict, so it
+  cannot be the worst of a set that contains real ones: a repo's `status` is the
+  worst *judged* finding, and `SKIP` only when nothing was judged (unregistered,
+  or an empty finding set). It used to outrank `OK`, which made five repos with
+  0 ERROR, 0 WARN and a dozen OK headline as "skipped" in org-ops census 05 —
+  `okr`, with the most OK in the org, read as unread. Fixing it in the status
+  alone would have traded that for the worse direction, "skipped checks look
+  clean", so coverage rides its own axis: `notChecked` in `--json`, a `· N not
+  checked` qualifier on the summary line. Absent `notChecked` means an older
+  engine and prints the pre-0.7.0 line — it is not zero.
 - **When a check fires many times in one repo, suspect the CHECK.** The first
   link pass produced ~30 findings against `llm-security` and all were noise —
   regexes in code spans, `file:` URLs, relative paths resolved against the wrong