fix: actually send where the binary came from, and cover the paths that fail

[w1ne]

binarySource shipped yesterday as a typed, documented field — with a paragraph in the module header explaining that it separates our release is broken from their PATH has something else on it — and no call site ever passed it. Every report read host_class: unknown.

A field with no producer is worse than no field: it makes a dashboard column that is always empty look like a finding.

resolveBinary already knew the answer at every step of its cascade and simply never said it. It now records configured / bundled / downloaded / path, and both report sites pass it.

Two failure paths that were still silent, after I called this surface covered:

• activate() — an extension that throws here is dead in the way a user reads as "the commands are missing", with no error anywhere they will look.
• the run itself — resolving the binary is half the Run button; the other half is where a binary that cannot start on this machine actually shows up, which is exactly the failure this whole release cycle was about.

The source registry lives in crashFingerprint.ts, the module with no editor import, because that is the third time today the same wall appeared: anything a unit test must reach cannot sit behind import * as vscode.

32 unit tests, tsc clean.