fix: attach govids_found/govids_missing to cog_balances() provenance

Mirrors R/spending.R:465-466 -- .check_govids_in_scope()'s return was
previously captured only for its message side effect. Also drops a
redundant duplicate assertion in the flow-code guard test.

tests/testthat/test-balances.R

@@ -144,7 +144,6 @@ test_that("no flow code can reach cog_balances", {
 
     expect_true(length(got) > 0L)
     expect_true(all(got %in% balance_codes))
-    expect_true(length(setdiff(got, balance_codes)) == 0L)
   })
 })
 
@@ -166,3 +165,15 @@ test_that("every balance_subtype maps to exactly one category", {
                         function(x) length(unique(x)))
   expect_true(all(per_subtype == 1L))
 })
+
+test_that("cog_balances records found + missing govids in provenance", {
+  skip_if_no_corpus()
+  with_fixture_corpus({
+    suppressMessages(
+      r <- cog_balances(c("550000227544", "XXXINVALID"), 2019)
+    )
+    prov <- attr(r, "provenance")
+    expect_equal(sort(prov$scope$govids_found), "550000227544")
+    expect_equal(sort(prov$scope$govids_missing), "XXXINVALID")
+  })
+})