Improve scanner credentialed coverage gates

[MAUROCERON]

Implements #1419.

Summary

• Adds a credentialed scan coverage evidence gate before trusting completed scan or empty result sets.
• Adds a coverage matrix for asset class, scanner/engine, credential source, auth result, local inventory proof, failed/not-attempted assets, coverage decision, and retest owner.
• Adds edge-case fixtures for credential failures, auth success without package inventory, mixed asset-class coverage, stale/offline agents, false-positive suppression before credentialed retest, and full credentialed coverage.

Validation

• Checked Markdown fence balance for the updated skill and new fixture.
• Verified required markers: Credentialed Scan Coverage Evidence Gate, Credentialed Scan Coverage Matrix, Authentication result, Scanner-specific proof, Local inventory proof, Coverage decision, Not Evaluable.
• Verified Tenable, Qualys, and Rapid7 reference URLs return HTTP 200.

Payment details can be provided privately after maintainer acceptance.