chore: add coverage ratchets to CI

[jflowers]

Summary

Add coverage threshold enforcement to CI to prevent coverage regressions.

Context

The canonical reference (unbound-force/unbound-force/.github/workflows/ci_local.yml) enforces two coverage ratchets:

• Global coverage >= 80%
• internal/backlog package coverage >= 90%

Replicator currently runs go test with -race and -count=1 but does not generate or enforce coverage metrics. The constitution (Principle IV: Testability) states: "Coverage regressions MUST be treated as test failures."

Acceptance Criteria

• CI generates a coverage profile (-coverprofile=coverage.out)
• CI enforces a global coverage threshold (determine appropriate starting value based on current coverage)
• CI fails if coverage drops below the threshold
• Consider package-level ratchets for critical packages (e.g., internal/org, internal/doctor)

References

• Parent issue: chore: add CI gate before release + pin action versions to commit SHAs #15 (out of scope item)
• Canonical reference: unbound-force/unbound-force/.github/workflows/ci_local.yml lines 45-61
• Constitution Principle IV: "Coverage regressions MUST be treated as test failures."