fix: close five final-review gaps in all-categories mode

- .detect_direct_suppressed() keys on (year, canonical_govid, category);
  all-categories mode collapses category to one literal value, so the key
  collides and the detector silently reports FALSE instead of "unknown".
  Report NA there instead, and stop isTRUE() in .build_provenance() from
  collapsing that NA back to FALSE. Schema widened to allow null.
- Refuse complete = TRUE + category = "All Categories": the completion grid
  has no per-category cells left to fill once categories are collapsed,
  so the prior silent 0-rows-filled result was never actually checked.
- cog_balances(category = "All Categories") returned zero rows with no
  error. .validate_verb_inputs() gains allow_all_categories (default
  FALSE); .verb_spendrev() passes TRUE, cog_balances() does not, so the
  three verbs share one place to reject it instead of drifting again.
- Fix the false `subtype = "operations"` argument claim (no such argument
  exists) in NEWS.md and an internal spending.R comment.

Adds three covering tests to test-all-categories.R for the three
behaviour changes above.

NEWS.md

@@ -5,8 +5,9 @@
 * `cog_spending()` and `cog_revenue()` accept the reserved category
   `"All Categories"`, returning one summed row per
   `(year, canonical_govid, subtype)` across every category inside the
-  requested concept's subtype scope. Combine with `subtype = "operations"`
-  for an operating-expenditure total. `cog_geographic_rollup()` inherits it,
+  requested concept's subtype scope. Filtering the result to
+  `spend_subtype == "operations"` gives an operating-expenditure total.
+  `cog_geographic_rollup()` inherits it,
   which is the efficient way to build a geographic total — previously a
   caller had to issue one rollup per category and sum the results
   (cog-api#37).