fix(coverage-guard): scope the ratchet to the files a change touches

[rubenvdlinde]

Adopts the canonical script from ConductionNL/.github (quality-config/coverage-guard.php).

The whole-project comparison fires on measurement noise. doriath#240 was a PR
whose entire diff was webpack.config.js — no PHP at all — and the guard failed
it: identical denominator (13723), both runs reporting exactly
Tests: 948, Assertions: 3051, Skipped: 1, and six covered statements of
run-to-run xdebug variance between them.

The measured --against floor cancels driver variance (xdebug vs pcov), as its
header says. It does not cancel run-to-run variance within one driver, and the
ratchet has no tolerance. Scoping the comparison to the PHP a change actually
touches keeps full strength where a regression matters and makes the noise
unreachable by construction — a diff with no PHP cannot fail.

New changed-files capability; the shared workflow PROBES for it rather than
assuming, so an un-updated copy keeps the previous behaviour instead of silently
accepting and ignoring the flag.

Script only — no behaviour change until the workflow passes --changed-files.
Byte-identical to the canonical copy (md5 5be122aad209da030c79b22a133232fb).

Pairs with ConductionNL/.github#473, which teaches the shared workflow to pass --changed-files.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/procest @ 021ca8c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		✅
composer			✅	✅ 104/104
npm			✅	✅ 535/535
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-16 10:19 UTC

Download the full PDF report from the workflow artifacts.