ci(coverage): risk-weighted coverage policy + diff-coverage gate

Adopt ADR 0004: stop chasing a single global coverage number and
measure what matters instead.

- Omit the genuinely-interactive `cli/init.py` shell (read_tty_line
  prompt loops) alongside the existing `cli/tui.py`, with a rationale
  comment in .coveragerc. Subprocess/backend orchestration is NOT
  omitted — it stays visible and is scored via the integration suite.
- scripts/coverage.sh runs unit + integration under one coverage
  measurement (the policy's yardstick) and can report the critical
  security/logic core held to the >=90% target.
- scripts/diff_coverage.py is a stdlib-only gate (no diff-cover dep):
  new/changed executable lines must be >=90% covered. This is the
  enforced regression guard; the global number is informational.
- CI gains a `coverage` job: combined report + the diff-coverage gate.
- Unit-test `cli/__init__.py` dispatch/exit-code mapping (it's logic,
  not I/O, so it earns tests rather than an omit).

Combined unit+integration coverage now reports 83% global / 87% across
the critical modules; per-module ratcheting toward 90% is the ongoing
work this policy frames.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NkwFXLFff9PYPy4wgVBJp9

scripts/coverage.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Combined unit + integration coverage (see docs/decisions/0004-coverage-policy.md).
+#
+# Runs the unit suite, then appends the integration suite (which skips
+# cleanly when Docker / the backend CLIs are unavailable), and prints one
+# combined report. The integration suite is what scores the subprocess /
+# backend orchestration modules, so the number here is the policy's
+# yardstick — not the unit-only badge.
+#
+# Usage:
+#   scripts/coverage.sh            # combined report
+#   scripts/coverage.sh critical   # also report just the critical modules
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PY="${PYTHON:-python3}"
+
+# Critical security/logic core held to the high bar by ADR 0004.
+CRITICAL="bot_bottle/egress_addon.py,bot_bottle/egress_addon_core.py,\
+bot_bottle/dlp_detectors.py,bot_bottle/egress.py,bot_bottle/manifest.py,\
+bot_bottle/manifest_egress.py,bot_bottle/manifest_agent.py,\
+bot_bottle/manifest_schema.py,bot_bottle/git_gate.py,\
+bot_bottle/git_http_backend.py,bot_bottle/supervise.py,\
+bot_bottle/yaml_subset.py,bot_bottle/bottle_state.py"
+
+rm -f .coverage
+
+echo "== unit ==" >&2
+"$PY" -m coverage run -m unittest discover -t . -s tests/unit
+
+echo "== integration (skips without Docker) ==" >&2
+"$PY" -m coverage run --append -m unittest discover -t . -s tests/integration
+
+echo "== combined report ==" >&2
+"$PY" -m coverage report -m
+
+if [ "${1:-}" = "critical" ]; then
+    echo "== critical modules (ADR 0004 target: 90%) ==" >&2
+    "$PY" -m coverage report --include="$CRITICAL"
+fi