chore(coverage): declare the gate in [tool.coverage.report] and measure only in test-ci

[lesnik512]

Summary

Converges the coverage gate on the modern-python standard, section 5: the 100 % gate is declared once as [tool.coverage.report] fail_under = 100, and coverage is measured only by just test-ci (and test-branch), never on every run through pytest addopts.

pytest-cov reads fail_under from the coverage config when no --cov-fail-under flag is given and applies it whenever coverage is measured, so the gate fires in test-ci exactly as before and a targeted just test run stays gate-free. coverage special-cases 100: the total must really be 100, no rounding.

Changes

• pyproject.toml: fail_under = 100 under [tool.coverage.report]; any --cov* flags removed from addopts.
• justfile: test-ci measures coverage and writes the XML report without the flag; test-branch likewise. Where test-ci did not exist it is added, and CI now calls it.
• .github/workflows/_checks.yml (where present): the pytest step runs just test-ci.

Checklist

• Lint and format pass (ruff) — config and recipes only
• Type check passes (ty) — no Python changed
• Tests pass and new behavior is covered — CI runs just test-ci, which is the gate
• Build succeeds — no packaging change
• Repo metadata stays consistent across the three surfaces — untouched