[kani] Validate complete proof result inventory

.github/workflows/ci.yml

@@ -728,6 +728,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Test Kani cover-result checker
+        run: python3 ci/check_kani_cover_test.py
       - uses: model-checking/kani-github-action@f838096619a707b0f6b2118cf435eaccfa33e51f # v1.1
         with:
           command: zerocopy/ci/run_kani.sh
@@ -743,8 +745,10 @@ jobs:
           # specifying a particular toolchain.
           # Memory-safety, overflow, undefined-function, and unwinding checks
           # are enabled by default. Kani 0.65 removed their positive flags.
-          # The custom command enters the `zerocopy` crate directory before
-          # forwarding these arguments.
+          # Kani 0.67 does not make an unsatisfied `kani::cover!` fail the
+          # invocation. The custom runner enters the `zerocopy` crate, keeps
+          # the combined output for diagnostics, and independently validates
+          # the complete per-harness result inventory from one fresh target.
           args: "--manifest-path Cargo.toml --package zerocopy --features __internal_use_only_features_that_work_on_stable --output-format=terse -Zfunction-contracts --randomize-layout"
           # This version is automatically rolled by
           # `roll-pinned-toolchain-versions.yml`.