test(ci): gate high-risk coverage scopes

[xingkaixin]

Summary

• explicitly include high-risk Core, CLI runtime, Web hooks, and Web interaction sources in coverage collection
• add independent line thresholds for each scope based on the measured baseline
• run the coverage gate in the Ubuntu smoke job

Impact

Coverage regressions now fail CI in the affected scope instead of being hidden by an aggregate repository percentage. Previously unloaded workers and hooks are counted as zero coverage rather than omitted from the report.

Baselines and thresholds

Scope	Baseline	Threshold
Core cache/runtime	87.51%	75%
CLI runtime	79.20%	78%
Web hooks	64.86%	63%
Web interactions	77.73%	76%

Validation

• pnpm test:coverage (662 tests)
• temporarily removed live-scan-store.test.ts; CLI runtime coverage fell to 35.39% and the gate failed as expected
• pnpm format
• pnpm lint
• pnpm format:check
• pnpm build
• pnpm test (662 tests)
• pnpm test:e2e (6 tests)

Closes CS-48