RISK-WP-0005 finished: the seven gaps closed

T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -1,13 +1,14 @@
 PY := python3
 TOOLS := tools
 
-.PHONY: help register check checked due fixes
+.PHONY: help register check checked due fixes coverage
 
 help:
 	@echo "make register  - rebuild REGISTER.md from findings/"
 	@echo "make check     - verify the index, report what is going quiet, and read the inbox"
 	@echo "make due       - just the work list: what needs a check right now"
 	@echo "make fixes     - the state of every fix this register claims to track"
+	@echo "make coverage  - what the register has never heard from"
 	@echo "make checked   - record a check outcome: make checked ARGS=\"RISK-F-0002 clean\""
 
 register:
@@ -30,3 +31,6 @@ due:
 
 fixes:
 	@$(PY) $(TOOLS)/fix_tracker.py
+
+coverage:
+	@$(PY) $(TOOLS)/coverage.py