Summary

• The coverage job collected data and uploaded to Codecov but never enforced
  thresholds — it always succeeded regardless of coverage values
• Codecov status checks (codecov/project, codecov/patch) weren't appearing
  on PRs, likely due to a missing/invalid CODECOV_TOKEN, and
  fail_ci_if_error was false so the upload failure was silent
• Branch protection had an empty required checks list (all-tests-passed was
  not listed), so CI failures couldn't block merges — now fixed

Changes

• Add in-workflow coverage gate to both ci.yml and coverage.yml that:
  • Enforces a minimum 85% line coverage threshold
  • Caches the main branch baseline via actions/cache
  • Compares PR coverage against baseline, fails if it drops by more than 1%
• Change fail_ci_if_error from false to true on Codecov upload
• Added all-tests-passed to branch protection required status checks

How the baseline works

• On pushes to main, the coverage percentage is saved to GitHub Actions
  cache with key coverage-baseline-<sha>
• On PRs, the most recent main branch cache is restored and compared against
  the PR's coverage
• First run after this merges will skip the reduction check (no baseline yet)
  and establish the initial baseline

Testing

• CI on this PR validates the gate runs (no baseline exists yet, so the
  reduction check was skipped, but the minimum threshold check ran and passed)
• After merging, the next PR that reduces coverage by >1% will fail