Draft: ci: report every Go test suite to the pipeline test report

What

Add --junitfile to every project-owned gotestsum invocation and declare the resulting report, so each Go suite appears in the pipeline's Test report tab.

Why

The tab currently shows two things: go_unittests, whose gotestsum invocation belongs to the golang-build component, and the two OCI/Maven conformance jobs, which wire JUnit because docs/plans/2026-05-15-oci-hosted.md:282 asked them to. On pipeline 2789914450 that is 19,829 unit tests plus 181 conformance tests. Every project-owned integration suite is absent.

That absence is not a decision. !725 (merged) introduced gotestsum across these jobs and scoped itself to console readability; its "Out of scope" section names the fuzz jobs, test:storage-failpoints and go_unittests, and neither the description nor any of its twenty notes mentions JUnit. --junitfile was never weighed.

gotestsum already runs go test -json and holds the parsed results, so --junitfile writes the report from data it has. Nothing re-runs and nothing is re-parsed.

How

• --junitfile on all 15 invocations in .gitlab-ci.yml, plus scripts/ci/datastore-test-shard.sh.
• when: always on the artifact blocks. The default, on_success, uploads nothing from a failed job, which would withhold the report in the one case a reviewer opens the tab for. Blocks that already carried a coverage_report inherit it, so a cobertura artifact now survives a red suite too.
• Jobs with no coverage profile share a new .junit-report anchor. The rest spell the two keys inline, because a YAML merge key replaces reports: wholesale instead of merging into it, so reusing the anchor beside a coverage_report would silently drop the coverage entry.

Interaction with this MR's target branch

Targets dmeshcharakou/751-shard-datastore-integration (!1781), which this MR's changes touch directly:

• The datastore shards get --junitfile coverage/junit-pg${PG_VERSION}-shard${SHARD}.xml, named per matrix instance for the reason that branch already documents for the coverage profile: the aggregator's needs: pulls all twelve instances' artifacts into one workspace, where same-named files overwrite each other.
• The shard job's "no artifacts:reports: here" comment reasoned about the coverage mean. JUnit does not enter that mean, so the comment now says which of the two it rules out and why.
• test:integration:datastore:coverage moves off the *cobertura-report anchor to an explicit cobertura-only block. It runs no tests, so inheriting the anchor's junit: would either find no file or, once the shard reports are downloaded there, count every datastore test a second time.

Test plan

CI is the test for a CI change. glab ci lint passes and shellcheck is clean on the shard script. After the pipeline runs, the Test report tab should gain a suite per integration job, named after the job.

Known gap

!1781 branches from a25d29e44, which predates test:lifecycle-failpoints on main. That job does not exist on this base, so it gets no JUnit wiring here and will need it re-applied when !1781 rebases onto main.