nightly coverage planner: detect drift between the workflow's flags map and SHARDS

## Context

PR #851 fixed #789 by defaulting the nightly coverage flag to the shard name (`.github/workflows/nightly-rust-coverage.yml`, `flags.get(name, name)`). The `flags` dict is keyed by shard name and lives in the workflow while `SHARDS` lives in `.github/scripts/ci_changes.py`; nothing checks that every key in `flags` still names a shard, so a renamed or removed shard leaves a stale mapping that is silently ignored.

## Acceptance

- `test_ci_changes.py` (or a workflow-structure test) asserts every `flags` key is a `SHARDS` key, and the planner refuses a stale one.

Compare the flags map in .github/workflows/nightly-rust-coverage.yml with SHARDS in .github/scripts/ci_changes.py. Start with test_ci_changes.py and inspect how the planner handles shard names. Done means stale flag keys are detected by a test or workflow-structure check and the planner refuses them.

Written by the indexing model from the issue text.