Draft: chore: a local coverage report, and where to read the CI ones

What

Add mise run test:coverage for a local HTML coverage report, and document the three ways to read coverage that already exist.

Stacked on !1931.

Why

Coverage had three viewing surfaces and no documentation pointing at any of them, so the practical answer to "which lines are untested" was to read a percentage and guess.

The CI HTML report needed no new plumbing at all. The golang-build component already runs go tool cover -html and archives coverage/coverage.html, and GitLab renders it in its artifact viewer, so the latest default-branch copy is a stable URL:

/-/jobs/artifacts/main/file/coverage/coverage.html?job=go_unittests

Verified: 302 to the newest go_unittests job, then 200. That URL is what !1931's unit badge links to. It was simply undocumented.

How

mise run test:coverage covers the local case. It reads the excluded-package regexp out of .gitlab-ci.yml instead of repeating it: GO_UNITTESTS_EXCLUDE_PACKAGES_REGEXP is a plain CI variable that the component reads at run time, so it has no other home to import, and a second copy would drift the first time a package is added to one and not the other. An empty read fails the task rather than silently running over the generated trees, whose 0% would swamp the total.

Measured on this branch: the task prints 66.8% and the go_unittests badge reads 66.80%.

No task wraps the integration suite, which leaves the comment in test:lifecycle-failpoints saying exactly that still true on main.

Scope note

The docs also record what none of the three views offers: a unit-and-integration total. Nothing computes one, so a reader who assumes one of these figures is it will be wrong by a wide margin. Profile merging happens in exactly one place, test:integration:datastore:coverage from !1781, and it is scoped to the twelve shards of one package rather than combining kinds of test.

Test plan

mise run test:coverage was run end to end: 68 packages, 19,831 tests, 66.8%, and an 11 MB coverage/coverage.html. coverage/ is gitignored so the output cannot be committed by accident. markdownlint and Vale pass with zero errors.