[B2] Infra flake: test:coverage:check SIGSEGV (exit 139) under concurrent coverage run

[SisyphusZheng]

Observed twice during Beta.1 (2026-09-03):

1. dev AutoFlow CI at 73a79000 (run 33715486563): test:coverage:check failed — tests failed with code 139 (SIGSEGV) from tools/check-coverage.ts:42; every other gate in the same run passed. Docs-only commit; no semantic cause.
2. B1.3 local qualification at 18778c95: one transient exit-139 SIGSEGV under concurrent load; clean re-run alone passed.

Likely a native-binding crash (rolldown/workerd class) under concurrency in the coverage subprocess. No semantic failure evidenced, but a twice-observed crash is a CI-stability risk worth root-causing (serialize the coverage run, pin native binding versions, or capture a core/stack).

Not a Beta.1 blocker: candidate-SHA CI is green and the failure mode is crash-and-fail-closed, never silent PASS. Part of #1155.

[SisyphusZheng]

Closed by PR #1292 (squash-merged to dev; auto-close does not fire for dev-targeted merges). Delivered the Beta.2 MUST: deterministic fail-loud bounded retry in tools/check-coverage.ts — exit <128 = real test failure (never retried, immediate fail); ≥128 = native crash (SIGSEGV/139 etc.), bounded retry (default 2 retries/3 attempts), each crash loudly reported with attempt count, exhaustion fails closed, each attempt starts from a clean coverage dir. Tool-level placement means the CI gate (autoflow:ci → test:coverage:check) and local share identical semantics. Root cause investigated with evidence: runner-level serialization not reachable (Deno runs modules serially; concurrency is inside tests' spawned subprocesses); blind native-binding pinning rejected as destabilizing without a repro. Trending signal: watch CI logs for [check-coverage] NATIVE CRASH lines.