fix(ci): enforce coverage floors from measured counts

[DecisionNerd]

Problem

The current Rust coverage ledger enforces floors using line_percent, rounded to two decimal places. Verified examples accept 94,999/100,000 at the 95% core floor, 79,999/100,000 at the 80% crate floor, and 89,999/100,000 at the 90% patch floor. The validator also accepts display percentages inconsistent with their covered/measured counts.

This is a bounded repair of #360's existing fail-closed coverage requirement, not a change to coverage targets or runtime behavior.

Acceptance criteria

• Enforce core, binding-adapter, per-crate, and patch floors from covered/measured counts without rounding the measured ratio before comparison.
• Reject a reported display percentage inconsistent with the generated rounded percentage.
• Preserve the existing empty-patch convention and rejection of empty production surfaces.
• Regression tests reject immediately-below-floor counts, accept exact and above-floor counts, and reject inconsistent percentages. Existing malformed, missing, stale, and inventory sentinels remain effective.
• Relevant script tests, formatting, repository checks, and exact-head CI pass before merge.

Scope

Only coverage-ledger enforcement and its deterministic tests. No threshold reduction, production-code changes, coverage exclusions, aggregate reconciliation expansion, or M5/S26 certification. #360 remains the canonical close gate.