ci(coverage): add coverage workflow (open-loop) on PR + main push

Runs vitest+v8 coverage on every PR and every push to main. Outputs:

- Workflow run summary table (lines / statements / branches / functions
  with covered/total counts) for at-a-glance visibility.
- coverage-data artifact (coverage-summary.json + lcov.info, ~220 KB,
  30-day retention) — small enough that future closed-loop tooling can
  download a base commit's data to compute deltas.
- coverage-html artifact (lcov-report HTML, ~5 MB, 7-day retention,
  main-only) for human download via the workflow run page.

Open-loop only — no PR comment, no delta gate. Closed-loop dark-factory
feedback (post deltas to the PR; gate regressions) is a follow-up;
the first attempt at the gate logic shipped four blockers in
adversarial review (gh run download flag, missing reporter file,
PATCH body encoding, heredoc terminator indentation), so split out
and ship the simple version first.

Adversarial review: subagent on this branch verified the simple
flow works in the Playwright container, container pin matches
build-and-test.yml, permissions defaults are sufficient, and the
artifact-namespace + concurrency-group combination doesn't collide.
The closed-loop design + its known blockers are tracked as a
follow-up issue.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/coverage.yml

@@ -0,0 +1,85 @@
+# Run vitest+v8 coverage on PRs and main pushes.
+#
+# Uploads the coverage report as an artifact for human download and
+# writes a summary table to the workflow run page. Currently does NOT
+# gate on threshold and does NOT post deltas to PRs — coverage is
+# informational. Closed-loop dark-factory feedback (PR comment + delta
+# gate) is tracked as a follow-up issue.
+#
+# Runs against the chromium browser project only. Firefox/WebKit
+# coverage is not measurable (JSC and SpiderMonkey don't expose V8's
+# coverage protocol). See vitest.config.ts coverage block for details.
+name: Coverage
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# One coverage run per ref; cancel in-progress runs when a new push
+# arrives so we always report on the current tip.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  coverage:
+    name: vitest+v8 coverage
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/playwright:v1.59.1-noble
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Install Bun
+        run: python3 tools/install-bun
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run coverage
+        run: bun run test:coverage
+        env:
+          HOME: /root
+
+      - name: Coverage summary
+        if: always()
+        run: |
+          if [ -f coverage/coverage-summary.json ]; then
+            echo "## Coverage summary" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Metric | Pct | Covered/Total |" >> "$GITHUB_STEP_SUMMARY"
+            echo "|---|---|---|" >> "$GITHUB_STEP_SUMMARY"
+            jq -r '
+              .total |
+              "| Lines | \(.lines.pct)% | \(.lines.covered)/\(.lines.total) |\n" +
+              "| Statements | \(.statements.pct)% | \(.statements.covered)/\(.statements.total) |\n" +
+              "| Branches | \(.branches.pct)% | \(.branches.covered)/\(.branches.total) |\n" +
+              "| Functions | \(.functions.pct)% | \(.functions.covered)/\(.functions.total) |"
+            ' coverage/coverage-summary.json >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      # Machine-readable artifacts (~220 KB), retained 30 days. Designed
+      # so a future closed-loop coverage workflow can download a base
+      # commit's data to compute deltas.
+      - name: Upload coverage data
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-data
+          path: |
+            coverage/coverage-summary.json
+            coverage/lcov.info
+          retention-days: 30
+
+      # Human-readable HTML report (~5 MB). Only on main pushes; short
+      # retention since PR runs don't benefit from it.
+      - name: Upload coverage HTML (main only)
+        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-html
+          path: coverage/lcov-report
+          retention-days: 7