ci(contracts): add a serial coverage baseline job

Run the full coverage suite on a single runner (SHARD_TOTAL=1) alongside
the unchanged 4-shard matrix. It does not upload to Codecov (the merge job
owns that) and serves as the serial wall-clock reference and a ground-truth
check that the sharded-and-merged coverage matches a single run; its lcov is
published as an artifact for that comparison.

Signed-off-by: Miguel_LZPF <miguel.carpena@io.builders>

Author: MiguelLZPF

.github/workflows/100-flow-ats-test.yaml

@@ -202,3 +202,58 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: packages/ats/contracts/coverage/lcov.info
           disable_search: true
+
+  # Serial baseline: run the FULL coverage suite on a single runner (SHARD_TOTAL=1) — the one-shot
+  # run that the sharded `coverage-ats` matrix parallelises. It does NOT upload to Codecov (the
+  # merge-coverage job owns that), and runs independently of the matrix. Kept as the wall-clock
+  # reference and a ground-truth that the sharded+merged report matches a single run; its lcov is
+  # published as an artifact for that comparison.
+  coverage-serial:
+    name: coverage (serial baseline)
+    runs-on: token-studio-linux-large
+    timeout-minutes: 45
+    env:
+      CONTRACT_SIZER_RUN_ON_COMPILE: "false"
+      REPORT_GAS: "false"
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Setup NodeJS Environment
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: .nvmrc
+          cache: "npm"
+
+      - name: Restore dependencies from cache
+        id: deps-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: |
+            node_modules
+            */*/node_modules
+            */*/*/node_modules
+            ~/.npm
+          key: ${{ runner.os }}-deps-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.deps-cache.outputs.cache-hit != 'true'
+        run: npm ci --ignore-scripts
+
+      - name: Run full coverage (serial, single run)
+        run: npm run test:coverage --workspace=packages/ats/contracts
+
+      - name: Upload serial coverage artifact
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: coverage-serial
+          path: packages/ats/contracts/coverage/lcov.info
+          if-no-files-found: error
+          retention-days: 1