fix(ci): adopt the merge-base coverage guard — hermiq was the last stale copy

[rubenvdlinde]

The defect, measured

quality.yml probes the repo's own guard before it will trust the ratchet:

php scripts/coverage-guard.php --capabilities 2>/dev/null | grep -qx against \
  || { echo "::error::scripts/coverage-guard.php predates merge-base comparison. Update it from ConductionNL/.github before enabling the ratchet."; exit 1; }

hermiq's copy was the pre---against 59-line version. It has no
--capabilities mode, so the probe exits 2 with no output, grep -qx against returns 1, and the job errors out.

That is exactly what the log says — run 31085325766, job 92563882183,
quality / PHPUnit (PHP 8.3, NC stable33):

##[error]scripts/coverage-guard.php predates merge-base comparison. Update it from ConductionNL/.github before enabling the ratchet.
##[error]Process completed with exit code 1.

That run is a pull_request run (32 jobs, not zero — the reusable workflow
resolved), so this is not the exit 99 "COULD NOT RUN" artefact a push-to-
development run produces. It failed identically on the re-run, so it is not a
flake.

The shape

This is the floating-caller / stale-callee problem one layer up from the
version pins. quality.yml is consumed @main and moved on; the per-repo
scripts/coverage-guard.php is a copy, and a copy has no ref to follow.
Every other repo adopted the new script — openbuild#137, pipelinq#716,
scholiq#286, decidesk#415, portaliq#49, shillinq#448, hrmq#71. hermiq is the
last one.

The fix

Replace scripts/coverage-guard.php with the adopted version. The file is
byte-identical to the copy on openbuild development and on scholiq
development (verified with diff), so there is one version of this script in
the fleet again.

Verified locally — both directions, not just "it didn't error"

probe	result
stale copy, --capabilities	no output, exit 2 → grep -qx against = 1 → CI error (the failure reproduced)
new copy, --capabilities	against / update-baseline / capabilities, exit 0
head 499/1000 vs base 500/1000	FAIL: coverage dropped by 0.1%, exit 1
head 501/1000 vs base 500/1000	OK: coverage improved by 0.1%, exit 0
base report with 0 statements	exit 2 — refuses to turn an empty report into a 0% floor
php -l	clean

The guard is shown to be able to fail before it is trusted to pass.

Not done

No baseline entry, no continue-on-error, no re-pinning hydra-gates-ref.
Nothing is silenced.

quality / Hydra Gates and quality / Quality Report also fail on
development for reasons unrelated to the coverage guard; they are left alone
here rather than folded into a CI fix.

[github-actions]

Quality Report — ConductionNL/hermiq @ b06a8c7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 117/117
npm			✅	✅ 744/744
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 09:03 UTC

Download the full PDF report from the workflow artifacts.