chore: add coverage enforcement

[francoischalifour]

Summary

• Add Bun coverage configuration for the CLI package with an 80% line/function threshold.
• Replace the plain unit-test step in CI and local verification with coverage-enabled test runs.
• Upload lcov.info from GitHub Actions so coverage can be inspected after CI.
• Tighten knip entrypoints by removing the CLI binary entry and the unused security binary allowance.
• Update contributor guidance to reflect the new coverage check and HTML coverage command.

Testing

• Updated the verification path to run coverage-enabled unit tests as part of the standard CLI gate.
• CI now produces an lcov artifact for coverage inspection.
• Documentation changes only beyond the test/verification workflow updates.

Risks

• Coverage thresholds may fail CI if existing tests do not exercise enough code paths.
• knip now relies on the test and script entrypoints only, so any future CLI entrypoint changes may require updating its config.