Add docs/testing-statement.md for the internal assurance team, describing
the testing approach (per ADR-002), what automated tests cover, the CI
quality gates, where evidence lives, and what is not covered by automated
testing and how each gap is otherwise assured.

Publish a human-readable test report to GitHub Pages on every main build
so the statement can cite a stable, per-build link:

- add pytest-html; the test stage emits a self-contained reports/index.html
  and uploads it as an artifact
- add a publish-test-report job to the main-branch workflow that deploys
  the artifact to Pages