[CI]: Improve CI and split out coverage as separate workflow

[spencrr]

Description

Separates coverage analysis from the CI test workflow into an independent coverage.yml workflow, and applies several CI hardening improvements.

Changes:

• Split coverage into coverage.yml: Coverage collection, reporting, and threshold enforcement now run in a dedicated workflow with a single Python 3.12 job, independent from the test matrix. This gives separate status checks in PRs — CI for correctness, Coverage for quality — enabling independent branch protection policies (e.g., requiring CI but making coverage advisory).

• Remove --cov from test workflow: The test job in ci.yml now runs plain pytest without coverage instrumentation, simplifying the job and slightly improving test performance.

• Add needs: lint to test job: Tests now wait for lint to pass before running, avoiding wasted compute on 3 matrix jobs when the code doesn't lint.

• Add timeout-minutes: 10 to all jobs: Prevents hung jobs from consuming runners for the default 6-hour limit.

• Coverage Job Summary: The coverage workflow writes a markdown coverage table directly to the GitHub Actions Job Summary page, providing visibility without external services or artifact downloads.

• Separated failure signals: Test failures and coverage threshold failures produce distinct step-level signals in the coverage workflow. The threshold is enforced via pyproject.toml [tool.coverage.report] fail_under (DRY — single source of truth).

Breaking changes

None. No changes to runtime code, test code, or pyproject.toml configuration. Branch protection rules may need updating to add the new Coverage status check if desired.

Checklist

• pre-commit run --all-files passes
• Tests added or updated for changes
• Documentation updated

[spencrr]

Coverage still expected to fail here, but tests passing 3.11-13 😄