ci-pipeline-cleanup Phase 10: coverage PR-comment action

Bundle: ci-pipeline-cleanup, Phase 10 / frozen decision 0.9.

Self-hosted alternative to Codecov / Coveralls. Posts a per-package
coverage delta as a PR comment on every PR; updates the same comment
in place on subsequent pushes (avoids duplicate noise).

scripts/ci-guards/coverage-pr-comment.sh:
- Reads coverage.out from the prior Go Test step
- Builds per-package coverage table (mirrors check-coverage-thresholds
  averaging logic)
- Searches existing PR comments for the '**Coverage report' marker
  and PATCHes the existing one if found, else POSTs a new one
- No-op on non-PR builds (push to master, scheduled, etc.)

Wired into go-build-and-test job after 'Upload Coverage Report' step
with if: github.event_name == 'pull_request' guard.

Operator can swap to Codecov/Coveralls later by replacing this script
+ step with a third-party action — the YAML manifest at
.github/coverage-thresholds.yml stays unchanged either way.

.github/workflows/ci.yml

@@ -124,6 +124,17 @@ jobs:
           path: coverage.out
           retention-days: 30
 
+      - name: Coverage PR comment
+        # ci-pipeline-cleanup Phase 10 / frozen decision 0.9: self-hosted
+        # alternative to Codecov / Coveralls. Posts a per-package coverage
+        # delta as a PR comment; updates in place on subsequent pushes.
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: bash scripts/ci-guards/coverage-pr-comment.sh
+
       # Bundle P / Strengthening #6 — QA-doc drift guards. Forces every PR
       # that adds a Part to docs/testing-guide.md OR a seed row to
       # migrations/seed_demo.sql to keep docs/qa-test-guide.md in sync. This