Wire control-plane/ into CI, mirroring the existing rees job pattern

[JSONbored]

Context

The control-plane/ package (added by PR #7543, feat(control-plane): provisionTenant/deprovisionTenant orchestration behind an injectable driver) has control-plane:install/control-plane:test scripts in the root package.json but zero CI coverage — .github/workflows/ci.yml and codecov.yml have no path filter, no job, and no Codecov flag for it anywhere. PR #7543's own body flagged this explicitly: "Wiring a path-filtered CI job (mirroring the rees job) is a mechanical follow-up I kept out of this change to avoid a large edit to the shared workflow file."

Requirements

Add CI coverage for control-plane/ that mirrors the existing review-enrichment (rees) job pattern in .github/workflows/ci.yml exactly:

• A path-filtered job that only runs when control-plane/** changes (same filter mechanism the rees job already uses).
• Runs control-plane:install then control-plane:test.
• Generates and uploads coverage under a distinct Codecov flag for control-plane, following the same pattern codecov.yml already uses for rees.

⚠️ Required pattern — mirror the existing rees job exactly. Do not invent a new CI job shape, a different coverage-upload mechanism, or a different path-filter approach. Two existing precedents for this exact class of task: PR #6527 (fix(ci): capture review-enrichment node:test coverage for Codecov) and PR #5567 (feat(miner-extension): add workspace package and CI wiring) — read both before starting.

Editing the shared .github/workflows/ci.yml file is sensitive — keep the diff minimal and scoped to exactly what's needed to add the new job, don't restructure existing jobs.

Deliverables

• A new path-filtered CI job for control-plane/ in .github/workflows/ci.yml, mirroring the rees job's shape.
• control-plane:install + control-plane:test run in that job.
• Coverage uploaded under a distinct control-plane Codecov flag in codecov.yml, mirroring the rees flag's configuration.

Test Coverage Requirements

This issue's own deliverable is the coverage-wiring — verify by confirming a Codecov report actually appears for the control-plane flag on the resulting PR. control-plane/**'s own existing tests (already present, just never run in CI) should now execute and report without modification.

Expected Outcome

A PR touching control-plane/** gets real CI test execution and Codecov coverage reporting, the same as every other package in this repo.

Links & Resources

• PR feat(control-plane): provisionTenant/deprovisionTenant orchestration behind an injectable driver (fake driver only) #7543 (the source of this deferred follow-up)
• .github/workflows/ci.yml's existing rees job (the pattern to mirror)
• codecov.yml's existing rees flag configuration (the pattern to mirror)
• PR fix(ci): capture review-enrichment node:test coverage for Codecov #6527, PR feat(miner-extension): add workspace package and CI wiring #5567 (precedent PRs doing this exact class of task)

[linear-code]

JSO-5435