ci(coverage): gate test assemblies at 100% and stop gating class rows

[Chris-Wolfgang]

Summary

This is #310 steps 4 and 5, ported from repo-template. pr.yaml here is far behind the template in other ways (trigger, guard, gitleaks), so only the coverage-gate steps change; this is not a full template upgrade.

pr.yaml: all three Enforce 90% coverage threshold steps (Linux bash, Windows pwsh, macOS bash) are replaced with the template's:

• Stage 1 parse bug: it read Summary.txt with a bare while read -r, which strips leading whitespace, so the ^[^ ] filter matched ReportGenerator's indented class rows and gated each class as if it were an assembly. It now uses IFS= read -r.
• Test-assembly threshold: assemblies built from projects under tests/ are held to the new CODECOV_TEST_MINIMUM: 100, and src/ stays at CODECOV_MINIMUM: 90. Test assemblies are identified by project location, never by name. A failing test assembly lists its classes below 100%.

release.yaml (step 5):

• It gets the same threshold split in Verify coverage threshold. I kept this repo's dotnet tool install -g dotnet-reportgenerator-globaltool, because the repo has no tool manifest.
• The coverage-collecting dotnet test calls now pass --settings coverlet.runsettings. Without it, release never instrumented the test assemblies, so the 100% rule had nothing to gate. The template has the same gap.

Verification

• Local Stage 1 simulation: Tests.Unit on net5.0–net10.0 plus Tests.Concurrency (test: add a concurrency stress suite #376), with --settings coverlet.runsettings, merged by ReportGenerator: Wolfgang.TryPattern 100%, Tests.Unit 100%, Tests.Concurrency 100%.
• The new Stage 1 gate script, extracted from this pr.yaml and run under Git Bash:
  • on that summary, passes, with src gated at 90 and both test assemblies at 100;
  • with Tests.Unit edited to 97.7%, fails with exit 1 and prints Classes below 100%: 97.7% …PropertyTests.
• Stages 2 and 3 and release.yaml are the template's code unchanged apart from the ReportGenerator install line. I haven't executed them locally; CI runs Stages 2 and 3.

Merge notes

• This touches .github/workflows/, so it needs an admin-bypass merge.
• Merge after test: bring the test assembly to 100% line coverage #373/test: add a concurrency stress suite #376 so every test assembly is already at 100%. test: bring the test assembly to 100% line coverage #373 has merged; test: add a concurrency stress suite #376 is independent and already at 100%.
• The companion non-protected PR updates scripts/build-pr.ps1 to match.

Refs #310

🤖 Generated with Claude Code