Flip coverage to a hard --cov-fail-under=80 gate

[alphacrack]

Summary

The coverage gate is currently a soft check. The CI comment in ci.yml says the v1.0.0 target is --cov-fail-under=80, "enabled as a soft check for now." Flip it to a hard gate once coverage is comfortably above the line.

Where

.github/workflows/ci.yml, the test job's coverage step. Add --cov-fail-under=80 to the pytest invocation.

What to do

• Run pytest tests/ -m "not e2e" --cov=iac_scanner --cov-report=term-missing locally and confirm the current line-rate.
• If ≥80%, add --cov-fail-under=80 to the CI command and remove the "soft check" comment.
• If <80%, this issue converts into "raise coverage to 80% first" — coordinate with a maintainer (may pair with test-gap issues).

Acceptance criteria

• CI fails when coverage drops below 80%.
• The stale "soft check" comment is removed.

Good first issue notes

Small CI change if coverage is already above 80%. Start by running the coverage command and reporting the number in the issue — that alone is a useful contribution. area:ci.