Make CI verify what ships, and name a comment hunk 'comment'

[longvo92]

Four commits: one report wording fix, then the top of a tech-debt audit — the
items where CI was reporting success without checking the thing it claimed to.

The report fix (2ce691d)

The file header called every non-real hunk "minor" while the group label a few
pixels below named the kind, so src/real_change.c read:

src/real_change.c   Modified   (1 hunk + 1 minor)
    comment + real

Two words for the same hunk. The counts now go through view_model.mode_of —
the mapping the rows, the group labels and the viewer already share — instead
of being re-derived by subtraction in report.py. mode_of is total, so no
hunk can drop out of the count; there is a test pinning that.

The note stays rather than being deleted under rule 7: it rolls up the whole
file, the group labels are per group, and a real-only file has no label at all.
The Qt viewer header never carried this note, so there was nothing to sync.

CI now runs the viewer (864b946)

The workflow installed nothing, so PySide6 was never present: 41 of 432 tests
skipped themselves on every leg and qtviewer sat at 0% coverage while the
run reported success. Measured, with and without Qt available:

	tests	skipped	coverage
local	432	0	84%
CI, as it was	432	41	48%

Qt goes on the 3.11 legs, with import PySide6 asserted as its own step — a
wheel that installs but cannot load would otherwise turn straight back into
silent skips. The 3.8 legs stay dependency-free on purpose: they are the proof
that the stdlib-only core still runs with nothing installed.

The stdlib-only promise has a test (864b946)

compare_tool.pyz is the documented fallback for machines where antivirus
blocks the .exe. Nothing checked that the core stays stdlib-only — one
third-party import in scanner.py would have kept every test green and broken
the tool on exactly those machines. tests/test_stdlib_only.py walks the
imports with ast and also holds the other direction: PySide6 only under
qtviewer/, and the modules named Qt-free in CLAUDE.md staying Qt-free.

Each guard was checked by planting a violation and confirming it fails, then
removing it — a guard that cannot fail is not a guard.

ruff as a correctness gate (864b946)

Narrow on purpose: E4, E7, E9, F, B, FA. The wide ruleset reports 311, of
which 178 are .format() → f-string; rewriting those is not this PR and a lint
nobody acts on is worse than none. FA is the one that earns its place — it
catches list[str] or X | Y written without from __future__ import annotations, the 3.8 trap that passes locally and fails on the 3.8 leg. ruff
reads requires-python, so there is no second target version to drift.

E741 is off with the reason in the config: l is this codebase's name for a
line of text in the diff hot paths.

Its six findings are fixed, including from None on four raise sites so a
handled error stops printing a second traceback under its own message.

Packaging and the pipeline example (aef7650, d65880a)

Nothing built compare_tool.pyz, so a staging regression would have been found
by a user on a locked-down machine. A job builds it on Windows (where the
fallback is used, and where build.ps1's path separators work), installs
nothing, runs it against the fixtures for exit code 1 and a non-empty report,
and checks the viewer is still inside the archive.

azure-pipelines.yml is linked from the English README as a working example but
was commented in Vietnamese down to the two <<SỬA>> markers a reader has to
find. Comments, step names and one echo are translated; both revisions were
parsed and compared to confirm no step, variable or command changed.

d65880a drops the archive-size figure from CI and six docs: a number that had
to be revisited on every change and that nobody acts on.

For the reviewer

• python -m unittest discover -s tests — 436 pass (432 + 4 new guards).
• python -m ruff check . — clean.
• The workflow itself cannot be proven until it runs here. Both bash steps were
  extracted from the parsed YAML and executed locally, so the heredoc and
  indentation risk is covered; libegl1 being enough for PySide6 on
  ubuntu-latest, and build.ps1 under the runner's pwsh, are what this first
  run actually tests.
• No CHANGELOG entries: none of this changes what the tool does.

Left for later, deliberately: _iface_kind, _swc_item and the AUTOSAR
category tuple are still duplicated between report.py and qtviewer/ — a
rule-3 violation worth folding into the next change that touches those files
rather than a commit of its own.