Export coverage as Cobertura XML

[davidanthoff]

Opened by Claude.

Why

GitHub Code Quality now stores coverage itself: a github-code-quality[bot] comment on the pull request with aggregate and per-file line coverage against the default branch, and a Restrict code coverage branch ruleset that can block a merge below a minimum percentage or beyond a maximum drop. It accepts Cobertura XML and nothing else, and this package could only write LCOV.

This is the first of five PRs wiring that up end to end (TestItemControllers → TestItemRuns → TestItemApp → julia-run-testitems → testitem-workflow). This one is self-contained and green on its own.

What

write_cobertura(io_or_path, result; root) in a new src/cobertura.jl, deliberately built as the twin of write_lcov:

• same root relativization through the shared _report_path, same / separators, same refusal to walk out of the root with ..;
• same "returns false and writes nothing when the run collected no coverage" contract, so a caller can drive both from one if — and a run without coverage leaves no empty file behind for something to upload as a real 0%;
• same skipping of entries whose URI is not a file: URI.

Cobertura describes branch and method coverage too. Julia's line-count instrumentation produces neither and Code Quality reads line coverage only, so those attributes are present — the format's consumers expect them — and always zero. A line Julia could not instrument is left out rather than reported as a line nobody ran: Cobertura has no "not applicable" hit count. Files are grouped into one <package> per directory, dotted, as the format's Java ancestry expects.

Verification

• 250/250 test items pass locally, including 4 new ones in test/test_cobertura.jl covering the no-coverage case, escaping, non-file: URIs, root relativization (absolute and relative roots) and the path-writing method.
• The output parses with a real XML parser (xml.etree.ElementTree), and its lines-covered / lines-valid agree exactly with the LH: / LF: totals write_lcov produces from the same TestrunResult.

Note

version goes to 1.12.0-DEV — additive feature, and the downstream [compat] bounds in the other four PRs assume "1.12". Say the word if you want a different number.

Unrelated, but noticed while editing: CHANGELOG.md's unreleased section has been headed ## [2.0.0] - Unreleased since the file was added, while releases have been shipping as 1.11.x. Left alone here.