fix(ci): stage coverage data under non-dot names so upload-artifact uploads them

upload-artifact@v3's glob silently skips hidden files, so uploading a
bare `.coverage.unit` logged "No files were found. No artifacts will be
uploaded" and registered nothing — the coverage job's download then 404'd
("List Artifacts failed: 404"). The coverage report step read the same
file fine, confirming it existed; only the leading dot broke the upload.
The old pipeline's cross-job artifacts (infra-candidate/, firecracker-
inputs) worked precisely because they were non-dotfiles.

Each test job now copies its .coverage.<suffix> to a non-dot
coverage-<suffix>.dat before upload (the cp also fails loudly if coverage
never wrote the file), and the coverage job renames them back to
.coverage.* before `coverage combine`.

.gitea/workflows/test.yml

@@ -66,11 +66,18 @@ jobs:
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
         run: python3 -m coverage report -m
 
+      # upload-artifact@v3's glob skips dotfiles, so a bare `.coverage.unit`
+      # silently uploads nothing ("No files were found"). Stage it under a
+      # non-dot name; the coverage job renames it back before `coverage
+      # combine`. `cp` also fails loudly if coverage never wrote the file.
+      - name: Stage unit coverage for upload
+        run: cp .coverage.unit coverage-unit.dat
+
       - name: Upload unit coverage artifact
         uses: actions/upload-artifact@v3
         with:
           name: coverage-unit
-          path: ${{ github.workspace }}/.coverage.unit
+          path: coverage-unit.dat
 
   integration-docker:
     runs-on: ubuntu-latest
@@ -98,11 +105,15 @@ jobs:
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
         run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
 
+      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
+      - name: Stage docker coverage for upload
+        run: cp .coverage.docker coverage-docker.dat
+
       - name: Upload docker coverage artifact
         uses: actions/upload-artifact@v3
         with:
           name: coverage-docker
-          path: ${{ github.workspace }}/.coverage.docker
+          path: coverage-docker.dat
 
   # Integration tests against the Firecracker backend. Runs on a self-hosted
   # KVM runner (label `kvm`) where /dev/kvm and the TAP/nft pool are available.
@@ -159,11 +170,15 @@ jobs:
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.firecracker
         run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
 
+      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
+      - name: Stage firecracker coverage for upload
+        run: cp .coverage.firecracker coverage-firecracker.dat
+
       - name: Upload firecracker coverage artifact
         uses: actions/upload-artifact@v3
         with:
           name: coverage-firecracker
-          path: ${{ github.workspace }}/.coverage.firecracker
+          path: coverage-firecracker.dat
 
       # Only upload the large rootfs artifact on main-branch pushes;
       # PRs avoid the ~194 MB transfer. publish-infra only runs on main
@@ -228,6 +243,14 @@ jobs:
           name: coverage-firecracker
           path: ${{ github.workspace }}
 
+      # Rename the non-dot upload names back to the .coverage.* files that
+      # `coverage combine` discovers (see the staging steps in each test job).
+      - name: Reassemble coverage data files
+        run: |
+          mv coverage-unit.dat .coverage.unit
+          mv coverage-docker.dat .coverage.docker
+          mv coverage-firecracker.dat .coverage.firecracker
+
       - name: Combined coverage (unit + integration, incl. firecracker)
         run: PYTHON=python3 bash scripts/coverage.sh aggregate critical