test(discovery): compute TP/FP/FN/DUP and field accuracy

[pengyuzhang]

Stacked on #62.

The measurement itself, and the shape of score.json. The run verdict — canaries and the gate — is the next PR: what the numbers are should not change when someone argues about what ought to fail a release.

Outcomes

outcome	condition	why separate
TP	installed, matched exactly once
FP	asset matches no installed entry	an invention; costs an operator real time
FN	installed entry matches no asset	a blind spot
DUP	installed once, matched by ≥2 assets	not a partial success

DUP is tracked apart from TP rather than folded into it. A duplicate inflates a fleet inventory, and treating it as mostly-a-success is what let it recur.

Only installed entries are scored

An entry a vendor no longer ships (unavailable), one that failed, or one no recipe implements yet leaves the denominator — but visibly. score.json reports each count, because a silently shrinking denominator flatters every recall number computed after it.

Field accuracy is never blended

Per field, over true positives only. A collector that always gets version right and always gets config_scope wrong has a specific bug; an average hides which. Version and path are compared against what the runner recorded installing, not against the manifest — the manifest states intent, and intent is not what is on the disk.

Empty denominators report null, not 1.0

A category with nothing installed has no recall. Recording a perfect score would flatter any average computed downstream.

Every finding is keyed by manifest id

So a regression reads as M-SITE-08 went from TP to FN, not as "MCP recall dropped".

Verification

Against the recorded run from #61, whose four defects are known:

$ python3 -m unittest discover -s tests -t . -q
Ran 48 tests in 0.023s
OK

totals:  tp=73 fp=2 fn=2 dup=5  recall=0.9733 precision=0.9733
misses:  M-SITE-08, T-RT-04                       (the two injected)
dups:    AG-01, AG-08, T-CHAN-01, T-CHAN-04, T-CLI-01   (one binary, two names)

The duplicate spanning five entries is correct and worth understanding: one tool reachable by two paths duplicates the base entry, both variants keyed to it, and the two states attached to it.