ci: summarize coverage gate

[jsugg]

Summary

• preserve coverage gate failure semantics while teeing coverage output into a log
• add an always-run job summary with the latest coverage output for easier threshold triage
• update workflow contract coverage for the new summary behavior

Validation

• pre-push hook: typecheck, unit tests, shellcheck
• npm run verify
• npm run test:coverage
• npm run workflows:lint:check
• npm run security:workflows
• targeted quality workflow contract spec