ci(test): no test coverage reporting or threshold enforcement in CI

[jongio]

Problem

Tests run in CI but no coverage metrics are collected, reported, or enforced. The local build system has a mage coverageReport target (magefile.go lines 106-117) that generates HTML coverage reports, but CI does not use it or any equivalent.

Evidence

• ci.yml line 82 runs go test ./... without -cover or -coverprofile flags.
• ci.yml line 87 runs go test -race ./... -count=1 also without coverage flags.
• magefile.go lines 106-117 defines a CoverageReport target that generates coverage.out and coverage.html, but this is never invoked in CI.
• No coverage threshold is defined anywhere in the project.

Impact

• No visibility into whether test coverage is improving or regressing over time.
• Contributors cannot see how their changes affect coverage without running mage coverageReport locally.
• No enforcement prevents merging code that reduces coverage below an acceptable threshold.
• The project has 69 test files with good coverage infrastructure (test helpers, fixtures, benchmarks) but no way to track coverage trends.

Suggested Fix

1. Add -coverprofile=coverage.out to the test step in ci.yml.
2. Upload the coverage artifact or integrate with a coverage service (e.g., Codecov, Coveralls).
3. Optionally set a minimum coverage threshold to prevent regressions.

Example addition to ci.yml:

- run: go test -coverprofile=coverage.out ./...
- name: Upload coverage
  uses: codecov/codecov-action@... # pinned SHA
  with:
    files: coverage.out

[jongio]

Consolidated into a single tracking issue.