fix(ci): coverage gate lcov→gcovr + ORT + lint upstream tests in-tree

[lusoris]

Summary

Three changes bundled because they share the same root cause (CI-stability
on master) and per the user-requested "doc-to-state in every PR" workflow:

1. Coverage gate fix — -fprofile-update=atomic for both C and C++
   in the coverage build (CPU + GPU jobs), unblocking 5 consecutive
   master CI failures.
2. Lint exclude — python/test/ excluded from Black/Ruff/isort
   (in pyproject.toml) and from the pre-commit hooks (in
   .pre-commit-config.yaml), because that tree is upstream-mirror
   code that gets wholesale-overwritten on every /sync-upstream.
3. Doc-to-state sweep — ADR-0110 captures the coverage-fix
   decision; docs/ai/roadmap.md updates 3 stale references from
   superseded ADR-0036 → ADR-0107; docs/development/release.md
   drops the "historically finicky" stigma on the coverage gate;
   docs/rebase-notes.md entry 0014; CHANGELOG entries.

Root cause of the coverage failure

geninfo: ERROR: Unexpected negative count '-44224' for
  libvmaf/src/feature/x86/vif_avx2.c:673.
        Perhaps you need to compile with '-fprofile-update=atomic'

meson test runs the unit suite in parallel; every test binary links
the same instrumented libvmaf.so. Multiple processes increment the
same .gcda 64-bit counters in SIMD inner loops without atomic
RMW → counter underflows → geninfo hard-aborts the gate. The
test_run_vmafexec failures in the pytest step are downstream noise
(that step runs under || true and never failed the gate by itself).

See ADR-0110
for the full alternatives table (skipping tests, meson test -j 1,
per-process GCOV_PREFIX, etc.).

Test plan

• CI Coverage gate passes on this PR
• Other 18 required status checks pass
• Local reproducer:

  cd libvmaf
  meson setup build-cov-test --buildtype=debug -Db_coverage=true \
      -Denable_avx512=true -Denable_float=true \
      -Dc_args=-fprofile-update=atomic -Dcpp_args=-fprofile-update=atomic
  ninja -C build-cov-test
  meson test -C build-cov-test --print-errorlogs
  lcov --capture --directory build-cov-test \
       --output-file build-cov-test/coverage.info \
       --ignore-errors mismatch,gcov,source,negative
  # Expected: completes without "Unexpected negative count"

• Lint smoke: pre-commit run --files python/test/quality_runner_test.py
  reports skipped for Black/isort/ruff hooks.

Six deep-dive deliverables (per ADR-0108)

1. Research digest: no digest needed — root cause was a single
   well-known gcov race documented in the GCC manual.
2. Decision matrix: in ADR-0110 §Alternatives considered
   (5 alternatives evaluated).
3. AGENTS.md invariant: no rebase-sensitive invariant — workflow-only
   change, no source-tree paths affected by upstream syncs.
4. Reproducer: see Test plan above.
5. CHANGELOG: two entries under ### Changed ("Coverage gate" +
   "Lint config").
6. Rebase notes: docs/rebase-notes.md entry 0014.

🤖 Generated with Claude Code

[lusoris]

Follow-up commit 0e8312c6 — the first attempt (-fprofile-update=atomic only) fixed the geninfo abort but exposed a second race I hadn't accounted for: at process exit, every parallel test binary merges its gcov counters into the same .gcda files for the shared libvmaf.so. That on-disk merge is itself unsynchronised, and -fprofile-update=atomic is per-thread (not per-process), so it doesn't cover this case.

Smoking gun: dnn_api.c — 1176% line coverage (hits > lines is impossible without merge corruption) with asymmetrically low counts on neighbouring DNN files in the same run.

Fix: pass --num-processes 1 to meson test in both coverage steps. Unit suite goes from ~30s to ~60s wall — rounding error against the 30-min job budget.

ADR-0110, CHANGELOG, and rebase-notes 0014 all updated to describe the two-part fix and the empirical evidence. Once this run produces honest per-file numbers we can decide what to do about the now-visible DNN critical-file coverage gap (model_loader/onnx_scan/op_allowlist/tensor_io at ~5–14% vs. the 85% bar) — that's a real, pre-existing gap that the merge corruption was masking.