[OPER-QA-11] Test-freshness cron — mark stale CoverageCells GRAY

feature_id: FEAT-studio-qa

## Context

Nightly cron that walks CoverageCell rows and demotes any with no runs in the freshness window (default 30d) to GRAY. Ensures the Coverage Grid never lies about coverage age.

## Acceptance Criteria

- `scripts/cron/qa-freshness.ts` walks CoverageCell where `updatedAt < NOW() - freshness_window`
- For each stale cell, calls `materializeCoverageCell` (OPER-QA-4) to recompute — will land as GRAY if no recent runs exist
- Registered as a Ledger cron task at 02:00 UTC daily
- Idempotent + safe to re-run
- Vitest coverage: (a) recent-runs cell not demoted; (b) stale cell demoted to GRAY; (c) partial freshness window respected