ci(coverage): remove || true test-masking (CLAUDE.md rule 12)

Per the audit at /tmp/ci-audit-2026-05-22.md, the coverage workflow's
test step was suppressing failures with `|| true` while still uploading
whatever partial coverage data accumulated. This made the workflow
report green even when tests failed silently — exactly the bug class
CLAUDE.md rule 12 calls out (shipped != verified).

Fix: drop `|| true`. Move codecov upload to `if: always()` so coverage
still uploads on test failures but the workflow conclusion now
reflects actual test status.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

.github/workflows/coverage.yml

@@ -32,8 +32,9 @@ jobs:
           go-version-file: cli/go.mod
       - name: Generate coverage
         working-directory: cli
-        run: go test ./... -short -coverprofile=coverage.out -covermode=atomic || true
+        run: go test ./... -short -coverprofile=coverage.out -covermode=atomic
       - uses: codecov/codecov-action@v4
+        if: always()
         with:
           files: cli/coverage.out
           flags: cli