Summary

Closes two step-security/harden-runner parity gaps that came up
in the gap analysis:

• Enriched $GITHUB_STEP_SUMMARY — report::render_step_summary
  now writes per-destination Network / per-path Files / per-binary
  Processes top-N tables into the step summary. Denied rows are
  flagged with ❌ and sorted to the top of the truncated table so
  the offending destinations surface even when the long tail of
  benign opens fills the rest. Pipe characters in commands and
  paths are escaped so a hostile filename can't break the table.
• coronarium policy suggest <audit.json> — new subcommand
  that reads a coronarium run --mode audit --log foo.json log
  and emits a starter policy.yml. network.allow gets one entry
  per host:port observed (hostname preferred over IP);
  file.allow gets one entry per parent directory observed;
  exec targets are surfaced as a commented # observed_exec:
  block so the operator can hand-pick what to deny — the
  suggester never auto-populates process.deny_exec. Reads from
  - as stdin too.

The remaining harden-runner gaps (SNI-based egress at the proxy,
workspace tamper detection, floating-tag → SHA-pin static check,
per-PID source attribution) are tracked under a new
"harden-runner parity gaps" section in CLAUDE.md so they don't
get lost. SaaS dashboard and automatic runner hardening are
explicitly listed as out-of-scope.

Side effect: Event gains a Deserialize derive (was
Serialize-only) so the audit log can round-trip through
policy suggest.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 14 new unit tests (8 in suggest,
  6 in report) on top of existing 80; all green
• Smoke: echo '{...samples...}' | coronarium policy suggest -
  produces a sane YAML with hostname-keyed allow entries and
  a commented exec block

🤖 Generated with Claude Code