Surface the REC coverage model (active captures, skipped/excluded containers, REC_MAX_NAMESPACES blind spots, host-fallback state) over a new read-only GET /api/rec/coverage endpoint and a 'vaultguardian rec status' CLI command. Pure observability; no capture/verdict changes.