ci: re-enable cargo-llvm-cov coverage on PR/push (#1107)

[oferchen]

Closes #1107.

Summary

• Re-enables .github/workflows/coverage.yml on push to master and on pull_request (it was restricted to workflow_dispatch in chore: disable coverage workflow on push/pull_request #3460 due to a deterministic SIGSEGV in nightly llvm-cov 22.1).
• Pins the coverage toolchain to nightly-2026-04-20, the last nightly known to work before the llvm::coverage::CoverageMapping::getInstantiationGroups regression. The pin is documented inline so it can be advanced once a known-good newer nightly is identified.
• Marks the threshold step continue-on-error: true so coverage stays informational and never blocks master, per the guidance to avoid breaking required checks while we climb toward the >= 95% line-coverage target.
• Keeps the existing --fail-under-lines 84 gate (Enforce coverage thresholds in CI #1652, Use cargo llvm-cov to enforce coverage thresholds #1691) so we record where we are without forcing a regression-free CI day on day one.
• Improves the $GITHUB_STEP_SUMMARY table: now records the target, the current informational gate, line and branch percentages, the gate outcome, and per-crate breakdowns. LCOV (line + branch) and HTML artifacts continue to be uploaded with 30-day retention.

Audit findings (Step 1)

• .github/workflows/coverage.yml already existed (added in ci: add cargo-llvm-cov coverage workflow #3012, threshold-enforced in Enforce coverage thresholds in CI #1652 / Use cargo llvm-cov to enforce coverage thresholds #1691, switched to nightly in fix(ci): use nightly toolchain for branch coverage #3382) but PR chore: disable coverage workflow on push/pull_request #3460 restricted it to workflow_dispatch only on 2026-04-30. It was therefore not running on PRs or master.
• No other workflow runs cargo llvm-cov or measures line coverage.
• Issue/tracker Fix connection limiter lock file handling #1107 in this repo is unrelated (a closed PR about lock files); the user-facing tracker is internal numbering for the beta-trigger criterion 3.2.
• Conclusion: real gap, this PR re-enables coverage measurement on every PR and master push.

Notes

• This workflow is intentionally not added to the required-checks set. It runs alongside fmt+clippy / nextest / Windows / macOS / Linux musl / interop and surfaces coverage informationally.
• Branch coverage continues to require nightly (-Z coverage-options=branch); line coverage is measured at the same time.
• Current measured coverage will be reported by the first run on this PR. Once it is stable at >= 95%, a follow-up should remove continue-on-error and tighten --fail-under-lines to 95 to satisfy beta-trigger criterion 3.2.

Test plan

• Coverage workflow triggers on this PR (was previously workflow_dispatch only).
• llvm-cov step completes without the SIGSEGV that motivated chore: disable coverage workflow on push/pull_request #3460.
• Step summary shows line %, branch %, gate outcome, and per-crate breakdown.
• lcov-report, lcov-branch-report, and coverage-html artifacts are uploaded.
• Job is non-blocking - failure of the threshold gate does not fail the workflow.
• All existing required checks (fmt+clippy, nextest stable, Windows stable, macOS stable, Linux musl stable, interop) remain green.