fix(coverage-changed): refuse stale or foreign reports via the coverage stamp

HU
40m ago
+416-61

Summary

The changed-line gate scored whatever lcov file it found: a stale report read as a verdict, a foreign-checkout report passed 0/0. This reuses verifyCoverageStamp from the CRAP gate: an absent stamp, a stamp naming another commit or working tree, or a narrowed run now refuses instead of a verdict, as does an lcov report recording files outside this checkout (the stamp cannot catch two checkouts of one commit). The refusal fires before the coverage-waiver label is consulted (a run-level test pins that order). Instrumentation comes from the verified stamp's include/exclude, shared with the CRAP gate; the duplicated SOURCE_ROOT policy is removed. Both gates share one outside-root scan via a predicate in stamp.ts, with no schema change. Stamp-excluded files under an include root have their code-like, non-test lines tallied as excluded-path lines, so new logic under an exclude entry shows in the job summary.

Closes #4379.

Validation

  • Base 5a836c05, head a69963e37.
  • Repro on base: 4 refusal tests failed on unmodified code; valid-stamp control passed.
  • pnpm check:coverage-changed:test: 38/38 pass; pnpm check:coverage-crap:test: 110/110; pnpm check:quick: exit 0.
  • Real route on a69963e37: pnpm test:coverage then check:coverage-changed --base origin/main — running; result to follow in the maintainer thread.
  • pnpm check:affected --run --head 253a1d670: all passed except unit — 198/17,826 timeouts at 5s in unrelated suites, same on base 5a836c05 (slow VM).
  • Review: internal debate, 1 real finding fixed; cubic 3 P3s addressed at a69963e37 (test-kit/fixtures tally, shared include matcher, tally wording).