ci: add coverage reporting and harden workflow

[ElliotSun]

Summary

Adds repository-native test coverage reporting without introducing an external coverage SaaS.

Changes

• add a dedicated Python 3.13 coverage job using pytest-cov
• emit terminal missing-line coverage plus coverage.xml and HTML coverage
• upload XML + HTML reports as a GitHub Actions artifact for 14 days
• keep the existing Python 3.11–3.14 test matrix unchanged
• set workflow-level contents: read least-privilege permissions
• add 30-minute job timeouts to prevent stuck runners

Deliberately not included

• no coverage threshold yet: establish the baseline first, then set a meaningful non-regression floor
• no Codecov/Coveralls or other external SaaS
• no mypy/type-check gate yet because the repository does not currently have a type-check configuration/baseline
• no broad Ruff expansion in this PR; current static check remains focused on fatal/error classes

Existing CI/security checks already present

• frozen uv dependency install
• Python 3.11–3.14 test matrix
• package build verification
• CodeQL on PR/push plus weekly schedule
• dependency review on PRs
• Dependabot for Python and GitHub Actions

Follow-up recommendation

Once this PR reports the first baseline, set a conservative coverage floor and consider a separate typed/static-quality PR for mypy/pyright plus broader Ruff rules rather than mixing repository-wide cleanup into this CI change.