Story: Entity classification and drift baseline: ores.reporting

Bring ores.reporting to the state the compass-codegen-fix-drift skill defines: every codegen-eligible entity bound to a profile or recorded as a genuine no-match, zero-diff regeneration verified, and any real gap the check surfaces fixed rather than skipped. Once trusted, reporting-cpp joins the known-drift-free registry that the drift gate checks.

• Every ores.reporting entity is bound to a matching Variability Profile, or recorded as a genuine no-match with a documented reason.
• Every rebound entity is regenerated and diffed against its pre-rebind checked-in output; zero diff is the pass condition, and any non-zero diff is fixed, not worked around.
• Full local build clean, schema drift current per compass db status, full ctest suite green after regeneration.
• reporting-cpp joins the KNOWN_DRIFT_FREE registry in check_component_drift.py (skill step 8), and the compass-pr-raise skill's local codegen-drift check runs --all over the registry, so future PRs touching ores.reporting fail on any regeneration drift.
• The superseded ad hoc task 'Apply safe drift to reporting-cpp' is marked ABANDONED, pointing here.
• Done shape (2026-09-07 program decision): the bind task closes at the drift gate. The story closes only after the post-merge live system test: recreate the database, provision a tenant, and exercise this component's flows. Defects the test surfaces get follow-up tasks on this story. The compute/iam binds set this shape: their live system test caught a service-grant defect ctest cannot see.

• Scope widened to hand-written code that should be generated (2026-09-17). The bind task now also brings un-modelled entities into codegen. The window found risk_report_config, report_input_bundle, and two risk_report_config junction tables with SQL tables and hand-written C++, and no org model. The user's mandate: hand-crafted code that should be generated is fixed in the same pass.
• The physical space table narrows the API surface (2026-09-17). The risk_report_config model disables ten addresses, because nothing writes a risk report config and the generated registrars have no composition point to join. Recorded in the bind task.
• Two steps for the Qt tier (2026-09-17). ores.qt/reporting holds 36 generated files that no CMakeLists.txt builds. ores.qt/compute builds 40 hand-written files with the same class names instead. Step 1, the bind task, lets the model edits regenerate into ores.qt/reporting and leaves the build alone. Step 2, a separate task, brings the templates to parity, wires the plugin, and deletes the hand-written copies.
• Two entities resolve to bespoke shapes, not to one profile (2026-09-17). Neither bind forced a profile onto an entity it does not fit. report_definition keeps uuid-identified-lookup and its explicit has_workspace_id: true override, because the product wants report definitions to record the live workspace. report_instance keeps fk-scoped-child and gains parent_entity_singular: report_definition, so a report definition explorer can open an instance nested under it. No new profile was needed.
• All story tasks are DONE; the story stays open (2026-09-17). The bind task closes at the drift gate, per the 2026-09-07 decision. The story waits on the post-merge live system test. Three entities stay hand-written as recorded exceptions in the bind task, each with the archetype gap that blocks it and a named revisit trigger. That is the recorded-exception path, not a silent omission.
• The drift gate reads its contract from the artefact it checks (2026-09-18). The populate reference check derives the lookup contract from the raise exception '<thing> not found guards and the select beside them in the upsert function bodies, rather than from a list of known lookups kept in the check. A hand-kept list would go stale against the functions and would report a clean tree whenever it disagreed with them. This is the same rule the codegen drift check follows, where the model is the contract and the generated output is the subject.

• The ores.dq artefact tier. About fifty dq_*_artefact_create.sql tables have one model between them. report_definition_template in ores.reporting mirrors one of those tables and cannot be generated until the tier is modelled. Recorded in the bind task.
• The four nullable scalars outside ores.reporting with no C++ default (ores.compute, ores.trading). Fixing them changes generated output for those components and breaks their drift gates. Recorded in the bind task.

Closed at sprint 25 close. Every task is done.