feat(coverage): deterministic test-coverage gate on deploy-staging->deploy edge (ORCH-027)

Introduce a deterministic (no-LLM) coverage sub-gate that blocks coverage
degradation before a task branch merges into `main`. Existing gates judge only by
the FACT of passing (check_ci_green / check_tests_passed / merge-gate re-test), not
by completeness — so a batch autonomous run (ORCH-088) silently erodes coverage.

Pattern mirrors the security-gate (ORCH-022): leaf src/coverage_gate.py (never-raise)
+ thin check_coverage_gate in QG_CHECKS + _handle_coverage_gate splice in advance_stage,
run AFTER merge-gate (measured on the caught-up HEAD that lands in main) and BEFORE
image-freshness (fail before the expensive docker rebuild).

- measure_coverage: pytest --cov=src --cov-report=json in the per-branch worktree ->
  line coverage %; None on tool error -> fail-open + WARNING by default (FR-6).
- compute_coverage_verdict (pure): absolute | baseline | both + epsilon (NFR-4 anti-flap);
  baseline None -> bootstrap (absolute-only).
- coverage_baseline DB table (additive, CREATE TABLE IF NOT EXISTS) + ratchet-up in
  _handle_merge_verify (deploy->done): atomic compare-and-set under merge-lease, never
  decreases; bootstrap on first merge.
- Artefact 18-coverage-report.md (coverage_status: frontmatter, single source of truth);
  GET /queue `coverage` block; FAIL -> Telegram; optional POST /coverage/baseline override.
- Flags ORCH_COVERAGE_* (kill-switch + self-hosting-only scope) -> enduro untouched;
  STAGE_TRANSITIONS / existing check_* / verdict keys byte-for-byte unchanged (NFR-5/AC-8).
- pytest-cov==5.0.0 added to requirements.txt.

Tests: tests/test_coverage_gate.py (TC-01..TC-15). Frozen QG-registry anti-regress
tests + deploy-staging edge tests updated for the new sub-gate. Full suite green.

Docs: README / adr-0029 / PIPELINE_DOCS / 18-coverage-report.md template (architecture
stage) + CHANGELOG / CLAUDE.md / .env.example (this PR).

Refs: ORCH-027
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main.py

@@ -170,6 +170,7 @@ async def queue():
     from . import merge_gate
     from . import task_deps
     from . import serial_gate
+    from . import coverage_gate
     from . import labels
     from . import cancel
     from .disk_watchdog import disk_watchdog
@@ -189,6 +190,9 @@ async def queue():
         # ORCH-088 (D9 / AC-10): per-repo serial-gate observability (read-only) —
         # active task, queued/waiting analyst-jobs, freeze state. Additive block.
         "serial_gate": serial_gate.snapshot(),
+        # ORCH-027 (FR-7 / AC-9): coverage-gate observability (read-only) —
+        # kill-switch, scope, policy/floor/epsilon, per-repo baselines. Additive block.
+        "coverage": coverage_gate.snapshot(),
         # ORCH-089 (D7): auto-mode-by-label observability (read-only) — kill-switch,
         # label names, scope. Additive block.
         "auto_labels": labels.snapshot(),
@@ -236,3 +240,23 @@ async def serial_gate_unfreeze(repo: str = ""):
         except Exception:
             pass
     return {"ok": True, "repo": repo, "cleared": cleared, "frozen": frozen}
+
+
+@app.post("/coverage/baseline")
+async def coverage_set_baseline(repo: str = "", value: float | None = None):
+    """ORCH-027 (D8): manually set/override the per-repo coverage baseline.
+
+    For a legitimate one-off coverage drop (e.g. removing a large tested module) the
+    operator sets the baseline directly here (by образцу ``POST /serial-gate/unfreeze``)
+    instead of waiting for the upward-only ratchet. Unlike the ratchet this CAN lower
+    the baseline. Alternative without this endpoint: temporarily flip
+    ``ORCH_COVERAGE_POLICY=absolute``.
+    """
+    from . import db
+    if not repo or not repo.strip():
+        return {"ok": False, "error": "missing 'repo'", "repo": repo}
+    if value is None:
+        return {"ok": False, "error": "missing 'value'", "repo": repo}
+    repo = repo.strip()
+    ok = db.set_coverage_baseline(repo, value, sha="manual-override")
+    return {"ok": ok, "repo": repo, "baseline": db.get_coverage_baseline(repo)}