1.2.0: feed measured coverage to the fallow-health report

[Cenadros]

Summary

report --coverage <path> (or report.coverage in .code-quality.yml; the flag wins) gives Fallow an Istanbul coverage-final.json so the advisory CRAP values use measured coverage instead of the 0 % estimate. The blocking gate does not change.

• src/report/coverage.ts: repository-relative path validation, directory form, realpath containment, regular file + 256 MiB cap, Istanbul shape check (path/s/f/fnMap), --coverage-root derived by scoring ancestor prefixes over the sampled keys (order independent, longest prefix wins ties).
• fallow-health: --coverage/--coverage-root, exit 2 accepted only with coverage, coverage: errors get an Istanbul hint, the coverage directory is excluded from Fallow scans unless it overlaps a configured path (then only the file is excluded).
• Unmatched coverage paths → one notice, CRAP stays estimated, exit 0. Missing / malformed / raw V8 input → exit 1 before any tool runs.
• quality.yml: opt-in report and coverage-artifact inputs; Validate coverage artifact before Check; Download coverage, Report, Upload quality reports gated on step outcomes.
• report.coverage is kept out of configHash; check untouched.
• scripts/integration.ts: ts-project report --coverage row against a committed Istanbul fixture asserting istanbul_files_matched >= 1.
• Docs: README report paragraph, config row, workflow inputs and "Coverage for CRAP" (same-job and artifact patterns), quality-gate.md. Version 1.2.0.

Test plan

• tsc, oxlint, vitest (59 files / 532 tests), build, actionlint, dogfood check PASS
• node scripts/integration.ts against the branch image: 14/14 rows ok including report --coverage
• launcher + branch image on a fixture copy: matched 1/1 with a /home/runner/work/... prefix, dir-form via config, absolute/missing/raw-V8 → exit 1, unmatched → notice + exit 0
• after merge: push v1.2.0, approve the staged npm version