feat(verification): risk-driven coverage policy, checkers, and CI gates - #203

Summary

Replaces the single "line coverage ≥ 80%" target with a risk-driven, six-dimension verification policy — and the gates to enforce it.

Policy (docs/design/11-verification.md, verification/)
Code / change / behavior / risk / effectiveness / system coverage. Tiered coverage-policy.json, expiring waivers.json, a scenarios.json behavior matrix, and a measured coverage-baseline.json ratchet.

Checkers (scripts/ci/, stdlib-only so the runner needs no PyYAML)

• check_coverage_policy.py — tier classification, waiver expiry/owner, floors, no-decrease, --enforce-tiers, --write-baseline
• check_scenarios.py — @scenario <ID> <kind> tags (unit/integration/e2e/fault)
• diff_coverage.py — changed-code coverage from lcov + JSON × git diff
• coverage.sh, mutation.sh, self-tests under scripts/ci/tests/

CI
Cheap static gates in ci.yml; the heavy instrumented build + changed-code gate + advisory mutation run in a separate coverage.yml (so instrumentation never holds the required ci check hostage); a weekly mutation.yml runs the Tier 0 full pass.

Commits

1. test: raise coverage on storage backends, CLI, and API smoke paths
2. test: fix silently-skipping pipeline_e2e and turn integration suites
3. test(verification): tag critical scenarios with @scenario
4. feat(verification): policy, checkers, and CI gates
5. ci(mutation): calibrate cargo-mutants --in-diff, arm the advisory PR check

Notable fixes

• pipeline_e2e and the turn integration suite referenced legacy gitignored fixtures that do not exist, so they skipped silently — and pipeline_e2e hung once fixtures were present because the pair sweeper is an intentional forever-task. Fixtures are now resolved corpus-first with a git-LFS-aware check, the sweeper is aborted after the finite stages drain, and the four genuinely-unreproducible tests are #[ignore]d instead of silently skipping.
• cargo-mutants --in-diff matches paths against the server/ workspace root, so repo-relative server/... paths silently select zero mutants. The patch is now generated workspace-relative, and mutation runs single-threaded --in-place (required because h-common reads the repo-root VERSION via include_str!).

Test plan

• cargo test --workspace
• cargo check --workspace --all-targets
• python3 scripts/ci/check_scenarios.py → 18 defined, 20 tag(s), OK
• python3 scripts/ci/check_coverage_policy.py --static
• checker self-tests (15 / 9 / 11 passing)
• Reviewer: mark the coverage workflow's rust / console jobs as required checks once merged
• Reviewer: confirm --enforce-tiers stays on (currently waived for the crates still ratcheting)

Follow-ups

• Promote the advisory mutation PR check to blocking once its false-positive rate is measured on real diffs.
• Auto-refresh coverage-baseline.json on merge to main (manual --write-baseline for now).