ci: add coverage gate and benchmark job, bump action pins

[lbliii]

Implements three tasks of #5 (hygiene baseline alignment): a coverage gate, a CI benchmark job, and current action pins.

Coverage gate

• Measured on Python 3.14t (free-threaded) after regenerating fixtures the same way the CI test job does:

  uv run python scripts/generate_fixtures.py --update
  uv run pytest -q --tb=short --cov=rosettes --cov-report=xml
  

  Result: 79.30% (7863/9915 lines, 2026-07-08).
• Added [tool.coverage.report] fail_under = 79 to pyproject.toml as an honest ratchet toward 80. pytest-cov picks this up from the existing --cov invocation in the test job — verified locally: Required test coverage of 79.0% reached. Total coverage: 79.30%.

Benchmark job (non-gating)

New benchmarks job in tests.yml:

• Installs pytest-benchmark + pygments at the job level (kept out of the dev group / lockfile since they're only needed here).
• Runs uv run --no-sync pytest benchmarks/benchmark_vs_pygments.py --benchmark-only --benchmark-json=benchmark-results.json (the file must be passed explicitly — python_files = ["test_*.py"] excludes benchmark_*.py from directory collection). 17 benchmarks incl. the Pygments comparison and the slow 10k-line cases; ~22s locally.
• Also runs benchmarks/benchmark_parallel.py for free-threading scaling numbers.
• Uploads benchmark-results.json as an artifact. No baseline comparison yet — that's the evidence epic (Epic: Evidence — prove the ReDoS-safety and speed claims (P1) #4).

Action pins

Bumped to ecosystem current (matching lbliii/kida) across all four workflows:

Action	Old	New
actions/checkout	v4	v7
astral-sh/setup-uv	v4	v7
actions/cache	v4	v6
actions/setup-python	v5	v6
actions/upload-artifact	v4	v7
actions/download-artifact	v4	v8
actions/upload-pages-artifact	v3	v5
actions/deploy-pages	v4	v5

pypa/gh-action-pypi-publish@release/v1 left as-is (floating release branch).

Verification

• Full test suite green on 3.14t with the gate active.
• Benchmark invocation and JSON artifact verified locally; parallel script runs clean.
• All workflow YAML validates.

Part of #5

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.