ci: enforce coverage and harden Silver checks

[JacobOptimiza]

Coverage enforcement

• Rust: scripts/rust-production-coverage.py computes production-only coverage from cargo-llvm-cov 0.8.7 JSON, excluding exclusively #[cfg(test)] items (never files or host code). Enforced in the CI validate job: >=80% lines and regions. Current: 87.60% lines / 86.30% regions / 89.42% functions. Analyzer has 18 unit tests (tests/coverage, also run in CI), including fail-closed on ambiguous source and threshold pass/fail paths.
• PowerShell: scripts/invoke-pester-coverage.ps1 — single Pester 6.1.0 run with JaCoCo coverage over DevNav.psm1, install.ps1, installer/ProfileIntegration.ps1; fails below 80% commands or lines. Current: 82.19% / 82.87%.
• JavaScript: scripts/invoke-npm-coverage.ps1 — Node native test coverage (--experimental-test-coverage, zero new dependencies) on the canonical Node 24 leg; fails below 80% lines. Current: 93.79% lines (Node reports line coverage; the historical 93.78% statement figure remains a baseline reference only). Node 22/26 legs keep the plain test run.

CodeQL languages/extraction

• Added javascript-typescript (build-mode: none, Ubuntu) alongside actions; the repo now has three analyses.
• Rust extraction investigation: baseline Ubuntu reported 10 files scanned / 9 with extraction errors / 1 clean. windows-latest was tried with the pinned 1.97.1 toolchain (build-mode: none unchanged) and produced the same 10 / 9 / 1, so it was reverted. FINAL configuration: Ubuntu + build-mode: none; the residual macro-expansion limitation is documented in SECURITY.md/ASSURANCE.md.

Silver documentation

• New ARCHITECTURE.md: real component layout, dev flow, result-file contract, config.tsv responsibilities, distribution channels, trust boundaries and local-vs-network scope.
• New ASSURANCE.md: claim/evidence/residual-limitation format covering build quality, >=80% coverage per language, dependency policy, static analysis, fuzzing, release integrity/provenance and version consistency.
• SECURITY.md: security controls updated (three CodeQL languages, residual Rust extraction limits, cargo deny, ClusterFuzzLite, coverage gates, checksums vs attestations) plus a trust-boundaries summary linking to ARCHITECTURE.md. Reporting policy untouched.
• ROADMAP.md: adds current maintenance/quality baseline and near-term quality work without dates; distribution status preserved verbatim.
• CONTRIBUTING.md: adds per-language coding standards and the new versioned coverage gates to the local gate list.

Gates

All green locally: cargo fmt/check/test/clippy/deny (171 tests), analyzer unit tests (18), Pester + coverage (114 tests), npm bootstrap tests + coverage, PS parser/PSScriptAnalyzer, workflow YAML validated, git diff --check clean.

Remaining limitations

• Rust CodeQL runs build-mode: none (per project policy: no autobuild/manual), so macro-heavy files may retain extraction diagnostics; residual is documented, not hidden.
• Code scanning alerts open today are Scorecard organizational rules (Maintained, CodeReview, SAST, BranchProtection) — not code defects; not pursued artificially.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.