Keep README test counts in sync via a CI-published badge #13

Problem

The unit/integration test counts were hand-maintained in ~6 places across README.md and docs/STATUS.md, with nothing verifying them. They drifted silently — a README spot still read "223 unit tests" while the real count had moved on.

Static counting can't fix this either: grep -c 'TEST(' over tests/unit reports 253, but only 244 actually run (parameterized/disabled macros expand differently), so a naive automated count would lie.

Proposal

Compute the counts from the built test binaries in CI and surface them as a shields.io badge, so the README number is generated rather than typed.

• scripts/count_tests.sh [build-dir] → "<unit> <integration> <suites>", counted via --gtest_list_tests (listing doesn't execute, so no Docker needed). Integration binaries are discovered by their ctest integration label, not a filename glob (two suites don't follow the *_integration_tests naming and a glob undercounts them).
• .github/workflows/build.yml (Linux job) renders a shields endpoint JSON and force-pushes it to an orphan badges branch using the built-in GITHUB_TOKEN (permissions: contents: write, job-scoped). Gated to push-on-main so fork PRs (read-only token) don't publish and the badge always reflects main.
• README.md embeds the endpoint badge once (top) and drops all hard-coded counts; docs/STATUS.md drops its headline totals and describes only what is covered.

Notes / caveats

• The badge image 404s until the first post-merge CI run on main publishes badges/tests.json (expected; goes live on first run).
• shields/raw CDN caching lags a push by a few minutes.
• Rationale recorded in docs/DECISIONS.md (2026-10-09 entry).

PR incoming.