ci: merge test+coverage; add ci:db / ci:prover subset gates

[TaprootFreak]

Summary

Two structural changes to the heavy CI lane. Test set is preserved bit-for-bit; the 100% line + function coverage gate stays as the authoritative pre-merge check.

1. Merge node-tests and coverage into a single test-and-coverage job

The previous topology ran the same -p node -p shared --all-features test set twice on the same self-hosted m3-ultra pool — once plain, once under cargo llvm-cov nextest. The instrumented run already produces test execution AND coverage data; the standalone node-tests job was pure duplication.

• Same strictness: --fail-under-lines 100 --fail-under-functions 100.
• Same ignore regex (main\.rs|lib\.rs|publisher\.rs|runtime\.rs|scanner_runtime\.rs|scanner_ws\.rs|flow\.rs|job_dispatcher\.rs|_tests\.rs$|bin/.*\.rs$) plus shared/src/.*\.rs$ so the coverage scope stays -p node while the executor runs both crates.
• Same RUSTFLAGS=--cfg coverage_nightly, same env vars, same sccache 50 GiB cap, same -E 'not binary(api_remote)' exclusion.
• One m3-ultra agent slot per PR instead of two → directly reduces the Colima / Postgres-container pressure that produced sporadic PoolTimedOut flakes when multiple PRs ran the heavy lane in parallel on dfx01.

2. Add ci:db and ci:prover subset gates

Two new lightweight jobs for faster developer iteration:

• db-tests (ci:db) — Postgres-backed surface (db / state / job_store / audit / username / r2_probe / publisher / runtime / commitment / jobs-API router subset / build_network_config crate-root tests / persist+load account_node tests). Plain cargo nextest run, no llvm-cov. ~15 min.
• prover-tests (ci:prover) — full account_node send / mint / receive surface (Plonky2 happy paths and pure-Rust error paths). ~25 min.

Both carry && !contains(... labels.*.name, 'ci:full') so a PR labeled with both runs only the heavy gate (superset). Both run on [self-hosted, m3-ultra] with the same env / sccache / DOCKER_HOST steps and a Telegram-alert step. ci:full remains the authoritative pre-merge gate.

Job topology after this PR

lint-and-build  (ubuntu-latest, always except draft)
       │
       ├──→ db-tests        (m3-ultra, label `ci:db`,    skips on `ci:full`)
       ├──→ prover-tests    (m3-ultra, label `ci:prover`, skips on `ci:full`)
       └──→ test-and-coverage  (m3-ultra, label `ci:full`)
                              │
                              └──→ notify-failure (Telegram)

Test plan

• CI on this PR runs lint-and-build only (no labels applied → no heavy lane).
• Apply ci:full label on this PR → test-and-coverage runs and the 100 % gate passes.
• Apply ci:db label on a separate PR touching only DB code → db-tests runs, no coverage gate.
• Apply ci:prover label on a PR touching account_node prove paths → prover-tests runs.
• Apply ci:full + ci:db together on a PR → only test-and-coverage runs (subsets correctly skipped).
• Release PR (develop → main, auto-labeled ci:full) still triggers the heavy gate.

Out of scope

• Postgres TEMPLATE-clone refactor (would further cut wall-clock by ~10 min via shared container + per-test DB clone). Deferred — the user prefers strict per-test isolation guarantees today.
• dfxai-host migration for runner pool. Separate workstream.