Vitest coverage threshold gate in CI

[jorgeraad]

Add a minimum coverage threshold to the Vitest config and fail CI when it drops. Pairs with #724 (broken-test detection) to make test-suite regressions visible.

Plan: pick a baseline threshold from current coverage (don't ratchet immediately), wire into test.yml, ratchet up over time.