feat(ci): opt-in coverage ratchet (default OFF — closes PMAT build-system audit gap #1)

[noahgift]

Gap

PMAT build-system audit gap #1: the strongest quality signal (line coverage) is purely advisory in the fleet-shared sovereign-ci.yml. The coverage job runs cargo llvm-cov but never enforces a floor, and the codecov upload is continue-on-error. A coverage regression therefore merges silently, despite the documented "95% coverage / ZERO tolerance" rule.

Change

Two opt-in inputs added to the reusable workflow:

input	default	effect
coverage_min	'' (empty)	line-coverage floor (%)
coverage_baseline_file	.pmat/coverage-baseline.txt	ratchet baseline path

A new enforcement step in the coverage job:

1. Derives line coverage from the just-produced lcov.info (sum of hit DA: records ÷ total) — no extra compile/test cost.
2. Computes effective floor = max(coverage_min, committed-baseline).
3. Fails the coverage job on a drop below it. The coverage job result is already wired into the top-level gate (needs: [...coverage...]), so a regression now blocks merge instead of merging silently.

It is a ratchet, not an absolute jump: a repo green today records its current % as the baseline, so enabling the gate can never break the currently-green state.

Safety — zero behavior change for every non-pilot repo

The enforcement step is guarded by if: ${{ inputs.coverage_min != '' }}. With the empty default, the step is skipped entirely — coverage stays exactly as advisory as today. Verified: of 73 fleet callers of sovereign-ci.yml, only aprender (the pilot, separate PR) sets coverage_min. The other 72 see no change.

Rollout ordering

This PR must merge before the aprender pilot PR — aprender's @main reference to the new coverage_min input is only valid once this lands.

🤖 Generated with Claude Code