ci: isolate plan UT coverage from parallel packages

[VioletQwQ-0]

What does this PR do?

This isolates the memory-heavy MatrixOne pkg/sql/plan coverage package from the other UT coverage packages. The first phase keeps the existing -p 6 package set minus the exact plan package; after it exits, a second phase runs plan alone with -p 1. Phase reports remain available on failure, and the final mode: set profile is merged with max-hit semantics and atomically published only after both phases pass.

The package scope, all-package coverpkg value, coverage filters, external-storage environment, runner pool, artifact names, downstream gate, and 45-minute coverage step are unchanged.

Which issue does this PR fix?

Consolidates the CI capacity failure in matrixorigin/matrixone#27408. The issue records three independent 14 GiB memcg OOMs that killed plan.test while -p 6 test/link/vet processes overlapped:

• run 32343057495, job 96353571118
• run 32353829219, job 96378718658
• run 32374962593, job 96450181698

This PR does not use Fixes so the MatrixOne issue remains open for post-merge canary evidence.

QA and validation

• QA required: no — CI scheduling/profile production only; no product runtime, SQL, or data semantics change.
• BVT: N/A — this is CI workflow tooling.
• Base: three independent 14 GiB memcg OOM producer failures, with reruns passing on the same heads.
• Review follow-up: go list now propagates partial-output failures; script-only changes trigger the helper/parser tests and bash -n; report append errors are returned without publishing a profile.
• Local PR-head validation: 38 passed, 3 xfailed across the helper, coverage parser, and CGo preparation tests; bash -n; git diff --check; semantic preflight PASS at head fb57c4f792864500bb7a08753df593af697f4337.
• Post-merge gate: at least 10 MatrixOne Coverage producer canaries across 3 heads, each with a profile, downstream merge PASS, no plan.test memcg OOM, and completion within 45 minutes.

The PR is intentionally Draft until the CI maintainers can run the upstream workflow and collect the canary evidence.

[VioletQwQ-0]

Addressed all three review findings on head fb57c4f792864500bb7a08753df593af697f4337:

• coverage-ut.yaml: capture go list | grep with command substitution before mapfile, so partial output with a non-zero producer status stops the job.
• check-action-file.yaml: watch scripts/** and run pytest for the helper/parser/CGo preparation tests plus bash -n; helper-only edits now receive a PR check.
• run_coverage_ut.sh: explicitly preserve the go-test status while returning report-append failures; no final profile is published on append failure.

Validation: 38 passed, 3 xfailed, bash -n, targeted actionlint (with the repository's existing custom-runner/expression diagnostics ignored), git diff --check, and semantic preflight PASS semantic=PASS.

[aptend]

Blocking security concern:

.github/workflows/check-action-file.yaml now triggers for any scripts/** change and then checks out the PR and executes PR-controlled Python test files on the self-hosted arm64-mo-shanghai-4c8g runner.

Because matrixorigin/CI is public, a fork PR can modify one of these test modules and obtain arbitrary code execution on the self-hosted runner once the workflow is allowed to run. permissions: contents: read limits the GitHub token but does not isolate runner files, network access, or infrastructure identity.

This validation only needs Bash, Python, and pytest. Please run it on a GitHub-hosted runner such as ubuntu-latest. If a self-hosted runner is mandatory, gate execution on a trusted organization member or safe label and ensure untrusted PR code is not executed before that gate.

The coverage phase split, failure propagation, report preservation, and max-hit profile merge otherwise look correct. Local validation passed: 38 passed, 3 xfailed, plus bash -n and git diff --check.