ci: collect Extended-Verification coverage as a byproduct of the integration jobs (no second run)

[mobileskyfi]

The standalone Coverage (metrics only) job in verify-extended.yml re-ran the entire suite (bun test --coverage test/unit/ test/integration/) as a second job, doubling Extended-Verification runtime on every dispatch with little added value. It was removed in #22 to stop the duplicate work. This issue tracks re-introducing coverage the right way.

Goal

Produce coverage from the integration run that already happens (one run, not two), and emit it per platform so coverage can be compared across Windows/macOS/Linux and x64/arm64.

Why it is not trivial

The integration jobs run tests in a per-file loop (separate bun test invocations) for CHR-boot isolation / sequential boot (avoids parallel-boot contention). bun cannot merge coverage across separate invocations, which is exactly why the old job used a single combined invocation instead.

Proposed design (validated: bun test --coverage --coverage-reporter=lcov --coverage-dir=<dir> works)

1. In each integration job’s per-file loop, add --coverage --coverage-reporter=lcov --coverage-dir=coverage to the existing bun test "$f" call. These flags do not change pass/fail, so the gating result is unaffected.
2. After each file, move coverage/lcov.info to a per-file name (it is overwritten each invocation), e.g. coverage/$(echo "$f" | tr "/." "__").lcov.
3. After the loop, merge all coverage/*.lcov with a small portable bun script (scripts/merge-lcov.ts, no deps) that sums DA:/FNF:/FNH: records and prints line% + function%.
4. Append the merged numbers to the job summary and upload coverage/ as coverage-<platform-label> for cross-platform comparison.
5. Guard every coverage step with if: always() + non-fatal (|| true) so coverage plumbing can never red a gating integration job.

Notes

• Keep it out of ci.yml (push pipeline already reports unit coverage); this is Extended-Verification-only.
• Coordinate with ci: refactor verification workflows into shared reusable units #29 (release/verification reuse) so the merge logic lands somewhere reusable rather than copied across jobs.

Follow-up from #22 (review item 3 — “rework the Coverage (metrics only) implementation”).

[mobileskyfi]

Closing this as folded into #29 rather than tracking it as a separate CI task.

The useful part of this issue is still preserved there: integration runs should emit coverage/stats as a byproduct of the existing per-file integration loop, not by running the suite a second time. That may end up broader than lcov alone, closer to a centrs-style integration summary/statistics scheme.

Sequencing note: this should not land before the reusable workflow-unit work in #29, because the right home is the shared integration runner rather than duplicated coverage plumbing in verify-extended.yml.