test(cli): comprehensive unit/integration/e2e coverage + CI-enforced gate

[paladini]

Summary

• Adds @vitest/coverage-v8 with a mandatory coverage threshold (lines/statements 95%, functions 95%, branches 80%) wired into CI as npm run test:coverage — the build now fails if coverage regresses.
• Switches the test suite to import from src/ instead of the compiled dist/ output (except cli.test.ts, which intentionally exercises the real built artifact via subprocess), so coverage numbers reflect actual source lines.
• Closes real test gaps: score.ts's maturity-level boundary logic (exact-percent assertions for every L1–L4 requirement), all 19 previously-untested check IDs (including all 4 of skills.ts, which had zero direct tests), report/terminal.ts, report/markdown.ts, report/badge.ts, and index.ts's public export surface.
• Adds a self-enforcing meta-test asserting every check ID in ALL_CHECKS has a direct test, so this can't silently regress.
• Adds dimension roll-up and badge↔score integration tests, plus 6 subprocess-based end-to-end scenarios covering full real-world flows: fresh-repo scan (JSON+terminal+markdown+badge), baseline→diff→markdown, --min-level gating at the exact boundary, self-audit dogfooding of this repo, combined flags in one invocation, and malformed-input rejection.
• Coverage moved from ~84% lines (with report/* at 0–10%) to 97.46% lines, 100% functions, 83.95% branches.

Test plan

• npm run test:coverage — 161 tests pass, coverage gate passes against configured thresholds
• Verified the gate actually fails on a regression (temporarily inflated a threshold, confirmed non-zero exit, reverted)
• npm run scan — repo still self-scores L4 · 108/108 (100%)
• npm run lint (biome) — clean
• npm run docs:build — clean