ci: select builds and HIL from a validated manifest (#4104)

CI build and HIL selection now come from one validated manifest (`check_build.py --select-only`): the selector replaces the path-filter gate, changed boards outside the pinned matrix get a `cmake-required` build, and every membrowse target uploads once per commit. Adds `coverage_audit.py` to check selection against real link graphs (0 missed builds over 247 master commits).

HIL: 18 cells red, all failing or flapping on master too; this PR changes no firmware.