test(coverage): widen branch buffer and add CI coverage-gate guidance

[Lobster-0429]

Summary

• Closes test(coverage): raise and stabilize global coverage at 97% #84. The 97% global coverage gate (vitest.config.ts) and the 97%-gate/98%-local-target guidance (CONTRIBUTING.md + PR template) are already in place on main; this PR widens the branch-coverage buffer above the gate and makes coverage failures self-explanatory in CI.
• Adds a CI Coverage gate guidance step that fires only when the coverage step fails and points contributors at the per-file table, the 97% gate, the local npm run test:coverage workflow, and the CONTRIBUTING coverage section.
• Adds targeted, real-branch tests (no shallow line-padding) for previously-uncovered fallback/branch paths.
• Global branch coverage 97.02% → 97.09% (9671/9960); lines 99.65%, statements 99.08%, functions 98.43% — all above 97% with headroom.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed. (Closes test(coverage): raise and stabilize global coverage at 97% #84)

Validation

• git diff --check
• npm run actionlint — clean (ran github-actionlint .github/workflows/ci.yml directly; the npm script's glob is a Windows-only shell limitation)
• npm run typecheck — clean
• npm run test:coverage locally — 959 pass (1 skipped); branch 97.09%, lines 99.65%, statements 99.08%, functions 98.43% (the 3 pre-existing Windows-only spawn failures mcp-cli, github-type-label, mcp-release were excluded locally and are unaffected)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Worker/MCP/UI/audit steps run in CI on Linux; the local environment has known Windows-only failures in mcp-cli/mcp-release/type-label tooling unrelated to this change.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (Settings-preview tests assert read-only scope and the existing forbidden-language sanitizer regression remains green.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (n/a)
• API/OpenAPI/MCP behavior is updated and tested where needed. (n/a — tests + CI only)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (n/a)
• Visible UI changes include screenshots or a short recording. (n/a)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (No changelog/snapshot files modified by this PR or the test run.)

Notes

• CI failure visibility: the new ci.yml step uses if: ${{ failure() && steps.coverage.conclusion == 'failure' }} so it only fires for coverage failures (not typecheck/lint), emitting a ::error:: with the 97% policy, where to find the per-file table, the local repro command, and the CONTRIBUTING reference.
• New tests cover real branches, not padding:
  • settings-preview: a generic needs-attention summary when install health is degraded with no missing permission/event; a qualifies-but-no-public-output sample that keeps install scope read-only (metadata: read, pull_requests: read) and lists no public output (requiredInstallPermissions / activeMissingPermissions / publicOutputsFor / publicOutputSummary fallbacks).
  • pending-pr-scenarios: regression tests for timed-out checks blocking merge readiness and stale approved PRs counting as pending closes with a correct post-cleanup open-count projection.
• Acceptance criteria: test:coverage passes at ≥97% for all four metrics with branch headroom; the template/guidance already state the policy; the test run modifies no snapshot or generated changelog files (verified via git status — only the three intended files changed).
• Most of the binding remaining branches sit in integration-heavy routes.ts/repositories.ts; per the issue ("targeted tests around existing behavior rather than inflating coverage"), those are left for incremental follow-up rather than padded here.

[JSONbored]

@web-dev0521 this is fine to merge.

A few notes:

• The guidance only appears when coverage fails, which keeps the normal CI path clean.
• The widened branch-buffer tests are a useful guard around the failure mode this is addressing.
• No code changes requested.

Validation expected:

• Keep the current green CI run.