ci(coverage): gate PRs on 100% patch coverage + 95% project floor

Adds diff-cover patch-coverage enforcement to the coverage workflow: every
changed line in a PR must be covered by a test (--fail-under=100), and total
project coverage must stay >=95%. Go coverage is converted to Cobertura via
gocover-cobertura so diff-cover can read it. fetch-depth: 0 lets diff-cover
resolve origin/<base_ref>; gated to pull_request events. New org mandate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: claude

.github/workflows/coverage.yml

@@ -17,6 +17,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: worker
+          # Full history so diff-cover can resolve origin/<base_ref>.
+          fetch-depth: 0
       - uses: actions/checkout@v4
         with:
           repository: InstaNode-dev/common
@@ -38,3 +40,40 @@ jobs:
           files: worker/coverage.out
           flags: worker
           fail_ci_if_error: false
+
+      # ------------------------------------------------------------------
+      # Org patch-coverage mandate: every changed line in a PR diff must be
+      # covered by a test (100%), and the project floor stays >=95%.
+      # Tool: diff-cover (https://github.com/Bachmann1234/diff-cover). The
+      # "Generate coverage" step is `|| true` so it still produces
+      # coverage.out even on a flaky test — the gate reads that file.
+      # ------------------------------------------------------------------
+      - uses: actions/setup-python@v5
+        if: github.event_name == 'pull_request'
+        with:
+          python-version: '3.12'
+      - name: Install diff-cover + cobertura converter
+        if: github.event_name == 'pull_request'
+        run: |
+          pip install diff-cover
+          go install github.com/boumenot/gocover-cobertura@latest
+      - name: Convert coverage to Cobertura
+        if: github.event_name == 'pull_request'
+        working-directory: worker
+        run: $(go env GOPATH)/bin/gocover-cobertura < coverage.out > coverage.xml
+      - name: Patch coverage gate (100% of changed lines)
+        if: github.event_name == 'pull_request'
+        working-directory: worker
+        run: |
+          git fetch origin "${{ github.base_ref }}" --depth=1 || true
+          diff-cover coverage.xml \
+            --compare-branch="origin/${{ github.base_ref }}" \
+            --fail-under=100
+      - name: Project coverage floor (>=95% total)
+        if: github.event_name == 'pull_request'
+        working-directory: worker
+        run: |
+          total=$(go tool cover -func=coverage.out | tail -1 | awk '{print $3}' | tr -d '%')
+          echo "Total project coverage: ${total}%"
+          awk -v t="$total" 'BEGIN { exit (t+0 >= 95) ? 0 : 1 }' \
+            || { echo "::error::Project coverage ${total}% is below the 95% floor"; exit 1; }