Let a flow config name the coverage sources its vPlan annotation reads

Nobody has claimed this yet.

Part of lowRISC/dvplan#129, which tracks formal support end to end.

`report/vplan.py` builds the annotation command with one vendor coverage report and one evidence file, and it derives the format name from the simulator. A formal run has its own report in its own format, and a config bundling a simulation run with a formal run has several. So the flow config should say what its sources are, and the command builder should splat them.

## Scope

- A `vplan_sources()` method on `FlowCfg` returning the coverage sources this config produced, each as a format name and one or more paths. The default is empty.
- `SimCfg` returns its vendor coverage report directory when coverage ran, plus the evidence file. Same two sources as today, same order, so the command it produces is unchanged.
- `VPlanInputs` takes the list, and `_process_command` stops naming `cov_report_dir` and `tool` itself.
- Replace the `f"{inputs.tool}_report"` concatenation with an explicit map from tool to format name. Right now the coupling to DVPlan's format names is invisible, and it is about to grow two formal entries whose tool names differ from the simulator ones.

## Done when

- The generated command for a simulation config is byte for byte what it is today, pinned by the existing tests in `tests/report/test_vplan.py` and `tests/job/test_cov_vplan.py`.
- An unknown tool name gives a clear error naming the tools that map to a format, which is the same complaint as #233.

Start with report/vplan.py, then trace FlowCfg, SimCfg, VPlanInputs, and _process_command to understand the current source and format handling. Run tests/report/test_vplan.py and tests/job/test_cov_vplan.py before changes. Done means simulation commands remain byte-for-byte unchanged and unknown tools produce a clear mapping error.

Written by the indexing model from the issue text.