ci: add coverage --min=95 gate with pcov driver

[Goosterhof]

Adds a coverage floor to a published public Composer package that shipped with coverage: none (kendo PHP-package cluster, sister to kendo-report-tool; first-contact recon Mod-1).

• pcov driver + composer test:coverage = pest --coverage --min=95 in ci.yml. Teeth = the --min CLI flag (not a <coverage> XML block — silent no-op on PHPUnit 10+). composer test kept driverless for external-contributor local runs.
• Measured 95.5% (floor set at the measured value, not an assumed 100). Drag is Jobs/ReportErrorJob async-carrier path (16.7%) + Scrubber.php:210; ratcheting toward 100 is a future Medic item.

No library source change; the PII-scrub invariant is untouched (separate concern). Armorer execution report: reports/kendo-error-tracker/execution/2026-07-14-armorer-coverage-gate.md.

🤖 Generated with Claude Code

[Goosterhof]

Self-review (author = reviewer = Goosterhof) — posting COMMENT per policy; verdict below.

Clean, scoped CI change: coverage: pcov + composer test:coverage (pest --coverage --min=95) on a package whose coverage source is already correctly scoped via <source><include><directory>src</directory> in phpunit.xml.dist (the PHPUnit 10+ shape — teeth is the CLI --min flag, not a silently-no-op <coverage> block). CI ran green on this exact head (check (8.4) / check (8.5) / ci-passed / town-crier/gate all pass), so the 95% floor is CI-proven, not just asserted in the PR body. No library source touched — matches the stated scope.

Two non-blocking observations posted inline (composer.json:45, .github/workflows/ci.yml:39) — floor-margin tightness and doubled coverage instrumentation across the matrix. Neither blocks.

Verdict: approve-worthy, no blockers.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[Goosterhof]

🟡 Minor (Confirmed, introduced) — floor is 95, PR body claims measured 95.5% — a 0.5pp cushion. The next unrelated PR that adds even a handful of untested lines to src/ trips this gate on a package with no active feature work in flight, turning a hygiene gate into unplanned CI friction on someone else's PR. Either set the floor a few points under the measured value (e.g. 90) to leave ratchet headroom, or confirm the tight value is a deliberate ratchet-toward-100 posture so the next contributor isn't surprised by a red build unrelated to their change.

[Goosterhof]

⚪ Nit (Confirmed, introduced) — composer test:coverage (pcov-instrumented) now runs on both matrix legs (8.4, 8.5) against the identical src/ tree — coverage is a property of the test suite, not the PHP version, so this doubles pcov instrumentation for no additional signal. Harmless at current runtime (23–24s/leg); if the suite grows, scope coverage collection to a single leg (e.g. if: matrix.php == '8.4') and leave the other leg on driverless composer test.

[Goosterhof]

✅ Approve-worthy

0 blockers · 0 majors · 2 minors · 0 nits · 0 praise · 0 inline

Round 2 — since 1fa7e17: 0 addressed, 0 new, 2 open (non-blocking). Diff content is byte-identical to round 1 (same two hunks, same lines); only the head SHA moved, consistent with a rebase onto the merged #18 dependabot bump (base_sha now 7b3d423). CI green on this exact head: check (8.4) / check (8.5) / ci-passed / town-crier/gate all pass.

Self-review (author = reviewer = Goosterhof) → COMMENT per policy. The two round-1 findings still stand at their original inline locations and are not re-posted here to avoid duplicate threads:

• 🟡 Minor — composer.json:45 — #20 (comment) (95% floor sits only 0.5pp under the claimed 95.5% measured coverage — tight ratchet margin).
• ⚪ Nit — .github/workflows/ci.yml:39 — #20 (comment) (coverage-instrumented run duplicated across both matrix legs against the identical src/ tree).

Neither blocks. Note for the merge queue (not a review finding): branch protection on main requires 1 approving review — a self-authored COMMENT doesn't satisfy it, so mergeable_state reads blocked pending either an ally APPROVE or an admin merge.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.