coverity: migrate to consumer-template architecture

Per dmf Kicksecure#67 (reusable refactor) + Kicksecure#68 (deadlock hotfix):

- New: .github/dm-consumer.yml with coverity.project-name +
  canonical-repos.
- Renamed: .github/workflows/coverity.yml -> consumer-coverity.yml,
  byte-identical to dmf canonical (no `with:`, secrets-only).

Behavior change:

- Cron slot moves from '30 6 * * 0' (Sunday 06:30) to
  '0 4 * * 5' (Friday 04:00) - the org-wide singleton slot in
  the canonical template.

Author: claude

.github/dm-consumer.yml

@@ -0,0 +1,19 @@
+## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+## AI-Assisted
+
+## Per-repo parameter overrides. Read at workflow runtime by the
+## reusable workflows in developer-meta-files. Top-level keys
+## mirror the consumer-template basename without the
+## 'consumer-' prefix.
+##
+## Spec:
+## https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md
+
+coverity:
+  ## scan.coverity.com project name. The URL renders the slash as
+  ## a dash for display ('/projects/Kicksecure-security-misc') but
+  ## the API form-parameter requires the actual slash.
+  project-name:    "Kicksecure/security-misc"
+  canonical-repos: "Kicksecure/security-misc,org-ai-assisted/security-misc"

.github/workflows/consumer-coverity.yml

@@ -0,0 +1,46 @@
+## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+## AI-Assisted
+
+## Managed by pkg_update_consumer_workflows. Byte-identical
+## across consumers; this file is `cp`-ed from
+## developer-meta-files/consumer-templates/.github/workflows/consumer-coverity.yml.
+## DO NOT hand-edit this file in the consumer repo - changes
+## will be overwritten on the next propagation pass.
+##
+## Per-repo values are read by the reusable from
+## .github/dm-consumer.yml at workflow runtime. Required keys:
+## coverity.project-name, coverity.canonical-repos. Optional:
+## coverity.apt-packages, coverity.build-command.
+##
+## Reusable docs:
+## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-coverity.yml
+
+name: Coverity
+
+on:
+  push:
+    tags:
+      - '*'
+  schedule:
+    - cron: '0 4 * * 5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+## Coverity singleton policy: G-A-006 in github-actions.md.
+## Cancelling mid-flight wastes the daily free-tier slot.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  coverity:
+    uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-coverity.yml@master
+    secrets:
+      COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+      COVERITY_SCAN_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
+    permissions:
+      contents: read