Whether every wire-contract publishing tool row records a valid wire contract

Audits every enabled tool row backed by an ACTIVE account of a provider that publishes a wire contract: it must record a digest that still matches its own stored schema and the live adapter contract. ok is false while any row is missing, mismatched, or unverifiable. Re-running the backfill clears missing and mismatched; unverifiable it cannot: the provider will not answer for that ref, so read blocked_by first. Note ok: true with checked: 0 means the scan matched no rows, not that the fleet is verified. Read-only. Internal admin users only.