feat(commerce): provisional-claim topbar on the report — click to verify

[viktormarinho]

Summary

The reports worker now grades a claim instead of blocking it (decocms/reports#313): a store owner logging in with a gmail gets a provisional claim — they see their report normally, but subscription/weekly runs require a verified one, and connecting the store's own GA4/GSC verifies it automatically.

This PR surfaces that state in Studio:

• A slim, full-width yellow topbar (black small text) above the Commerce Discovery report tab, shown only while the org's claim is provisional. Clicking it opens the connect-sources tab, where connecting a source resolves it.
• Fail-soft by construction: no siteUrl, a loading/failed status query, a worker deployed before the claim field, or a verified claim all render nothing — the report never breaks because of the strip.

Plumbing

• fetchCommerceDiscoveryConnectionStatus + COMMERCE_DISCOVERY_CONNECTION_STATUS pass the new claim: { method, verified } | null through (schema is optional-tolerant for older workers); tool-io.ts updated to match (hand-edited — the local generator run produced an env-dependent subset, so only the changed entry was touched).
• useCommerceDiagnostic now exposes the connection's siteUrl (the argument the reports tools expect).
• Banner reuses the same query key as the connect-sources cards, so a binding write over there invalidates the strip too.

Testing

• bun run --cwd=apps/web check and --cwd=apps/api check pass; bun run fmt clean.
• apps/api reports tests: 29 pass, incl. new cases — claim passthrough and absent-field tolerance.

Depends on decocms/reports#313 being deployed for the field to be non-null (already merged; without it the banner simply never shows).

🤖 Generated with Claude Code

---

Summary by cubic

Adds a slim yellow topbar to the Commerce Discovery report when a store’s claim is provisional. Clicking the bar opens Connect Sources to verify ownership by linking GA4 or GSC. The UI fails soft and never blocks the report.

• New Features
  • Show the banner only when claim.verified is false; clicking opens connect-sources.
  • Shares the same query key/tool as connect-sources, so binding updates invalidate the banner.
  • API now returns claim via fetchCommerceDiscoveryConnectionStatus; COMMERCE_DISCOVERY_CONNECTION_STATUS output and tool-io updated.
  • use-commerce-diagnostic exposes siteUrl for tool calls.
  • Handles missing siteUrl, loading/failed queries, older workers without claim, or verified claim by rendering nothing.

^{Written for commit 91d7ef6. Summary will update on new commits.}