Add lab coverage: specs with coverage, then undercoverage

Adds just lab coverage [--instance NAME] [--base SHA] SPEC... for a dev rig. It runs the specs with SIMPLECOV=1, then scripts/undercoverage against the base, and prints a PASS or FAIL tail. It fails on zero examples or a stale coverage file. monorepo.md names it in the coverage step.

Proof: just ci green locally, shellcheck clean on the new script, just --dry-run resolves the recipe. Not run on a rig.

Supersedes !94 (closed), whose commit lacked the sign-off.

AI-Assisted: yes