Coverage tiers: manifest, mutation scope, native coverage and agent guidance

[Disble]

Replaces #75. That pull request was opened before main advanced 18 commits and could not
compute a merge, so CI never started; this branch carries the same eighteen commits rebased onto
main with the conflicts resolved (goldens regenerated, steps.go keeping both intents, the
learning log appended) and every rebased commit re-run through the repository gate.

Coverage tiers: manifest, mutation scope, native coverage and agent guidance

Four units that let a consumer declare its feature coverage tiers once, have the local
gate enforce them through the project's own Vitest, and give agents bounded guidance
without the gate ever depending on that guidance.

What is in it

Unit	What it does	Commits
T1	coverage-tiers.json and one Go resolver (tiers.Resolve, read-only dharness policy --root)	c2ac282, b86b56f, cddacb7
T2	Tier-aware mutation scope: declared infrastructure is excluded before measurement, verdicts and index-based membership are preserved	54f17db, 379369d, 7867858
T3	Native coverage inside the existing workflows and the local gate: config splicer, embedded runtime, setup step and hook wiring	4b93674, 21da2cf, c874e5e, 90cd824, fcbc396
T4	Embedded skill (go:embed) with copies for .claude/ and .agents/, plus one bounded managed region in AGENTS.md/CLAUDE.md	6c22793, 3869c4a

Also included: the raw-export parser (983b48a), a scope correction so coverage adoption stays
inside the existing workflows (99b1eff), and the campaign lessons in docs/learning-log.md
(cc6d95c).

Mutation evidence

Scope	Scored	Killed	Survived	Score
internal/setup/assets/coverage-tiers/runtime.mjs	533	510	23	0.9568
internal/setup/coverage_tiers_config.go	147	146	1	0.9932
internal/setup/coverage_tiers.go + runtime accessor	92	88	4	0.9565
internal/tool/coverage_workflow.go	38	38	0	1.00
internal/setup/coverage_tiers_skill.go	36	35	1	0.9722

No exclusion, suppression or threshold change was used. The 29 surviving coordinates are
equivalent mutants, each verified before it was accepted:

• Splicer 113:13 — equality of the two first-occurrence indices needs one marker to be a
  prefix of the other; all three marker pairs are prefix-free.
• Setup 414:43, 554:4, 559:44, 561:4 — an unreachable conjunct (coverageTiersWired
  already fails closed on an empty native config), a SplitAfter piece that can only be empty
  last, a line-ending offset that cannot differ for one newline at the end, and a break that is
  the loop body's last statement.
• Runtime 23 coordinates — independently verified by a second reviewer that reproduced the
  execFileSync error shapes itself: no shape carries both a truthy code and a numeric
  status; every shape reaching the later lines has a decoded stderr or returns earlier; the
  spawn options and the Number.isFinite disjuncts are unobservable or dead. Two boundaries are
  stated rather than hidden: 456:46 and the two array fallbacks are equivalent relative to a
  policy answer's contents, not by construction.
• Skill 196:72 — a capacity hint whose mutant computes zero while the directory and document
  tables have equal length.

Each entry carries its argument and the change that would invalidate it; the full ledger stays in
the session evidence and can be committed if you want it in-tree.

Test plan

• go test -count=1 ./..., go vet ./..., go build ./..., gofmt -l ., git diff --check — green on the final bytes, with the repository gate (gofmt, vet and the suite over the materialised index) run on every commit.
• Mutation measured with ditto staged (Go scopes) and StrykerJS (the runtime asset) at the unchanged 1.00 threshold.
• Native lifecycle, run with a binary built outside the checkout against disposable consumers: first-refusal Husky hooks exit 1 while dharness check exits 0 on an empty staged index; a real git clone of the tracked tree runs the hook at 100% coverage and fails once a new unimported CORE file appears, with no second sync.
• The thirteenth step observed in a real consumer: both skill copies byte-identical to the embedded source, exactly one managed region, the project's own bytes preserved, an undeclared repository gaining nothing, and partial or duplicated regions refused.
• CI runs go test ./... -race, which the local gate deliberately omits; that is the one check this PR cannot show locally.

Declared limits

• Mutants that never compiled are outside the score in two scopes by the tool's own accounting.
• Two runtime equivalences are scoped to a policy answer's contents.
• POSIX signal-only shapes for the runtime's 253 line do not exist on this host.
• CRLF combined with a mid-line statement is measured but has no permanent test row.
• The reference step's activation rule is deliberately independent of the coverage step's.

Merge

Multi-unit branch: rebase, never a merge commit, and the title above is deliberately not a
conventional commit so a future squash cannot make release-please count an entry twice.

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE