CI build-config verification job emits static PASS instead of runtime-computed scan count

## Process-gap

The generated CI job that verifies a build-config toggle is OFF (asserting no guarded-tool invocations are present/unguarded when a feature toggle is disabled) emits a static "PASS" echo rather than reporting a runtime-computed count of the invocations it actually scanned. If the grep/scan logic silently matches zero lines (e.g. due to a pattern change or a file move), the job still prints PASS — providing false assurance with no positive-coverage signal.

## Proposed mitigation

Have the verification job compute and print the number of candidate invocations scanned and the number found guarded vs unguarded, and fail (or at minimum warn) if the scanned-candidate count is zero when the workflow is expected to contain guarded steps. Positive coverage ("scanned N, all guarded") is more trustworthy than an unconditional PASS echo.

## Severity
Low — the assertion is fail-safe in the common case, but a silent zero-match degrades the verification artifact to a no-op.