Backend probe: CI gate ensuring every tier/backend stays probe-covered

@huzaifa-d is already working on this.

Since Aug 7, 2026.

### Description of the task

Follow-up from @bbonaby''s review of #717: **future-proof the backend probe against new tiers and backends.**

A tier 4 may be added to the AppContainer fallback ladder (per @bbonaby), and new containment backends land over time. Today, `available_backends()` and the isolation-tier reporting must be updated by hand when that happens, and nothing fails if someone forgets.

**Ask:** add a PR-pipeline / CI gate that fails if any `IsolationTier` variant or `wxc_common::wire::Containment` backend is not represented in the probe''s detection/mapping, so a future tier 4 (or a new backend) cannot silently regress probe coverage.

### Additional context

- The `available_backends()` probe landed in #725 and already consumes `IsolationTier::as_str()` (not literals), guarded by a drift-check unit test (`CANONICAL_TIERS` tied back to `as_str()`). This issue is the broader structural coverage gate, not the string-centralization itself.
- The related string-centralization cleanup (`IsolationTier::FromStr` + migrating appcontainer call-sites off raw literals) is being handled directly in #725.
- Origin: review threads on #717 (doc lines 42 and 119).