feat: extend coverage-gate with install command and artifact upload

[rldyourmnd]

Summary

Extends coverage-gate.yml with four new optional inputs. All default to the
prior behaviour, so existing callers are unaffected.

• install_command (string, default '') — command that installs the coverage
  tool, e.g. cargo install cargo-llvm-cov. Empty to skip; runs before the
  coverage command (fail-fast bash -euo pipefail, value via env:).
• upload_artifact (boolean, default false) — when true, uploads the coverage
  report file as a workflow artifact.
• artifact_name (string, default coverage-report) — artifact name.
• artifact_path (string, default '') — path to the report file to upload;
  required when upload_artifact is true.

When upload_artifact is true, a new guarded step uploads via the full-SHA-
pinned actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
(canonical repo pin) with if-no-files-found: error so a missing report fails
closed. The install step mirrors the fail-fast runner used by
private-static.yml.

Type of change

• Extension to an existing workflow

Threat-model note

No new network egress; the only new third-party action is the already-canonical,
repo-wide actions/upload-artifact pin (no new supply-chain surface). No
permission scope change — upload-artifact uses the default job GITHUB_TOKEN
and needs no scope beyond the existing contents: read. install_command runs
arbitrary caller bash, but so does the existing coverage_command — both are
caller-owned and pass through env: only (no ${{ inputs }} in run:).

Permissions diff

No change. coverage job keeps contents: read only.

Checklist

• Third-party actions pinned to full 40-char SHA + # vX.Y.Z comment
  (upload-artifact uses the repo's canonical pin).
• Least-privilege permissions (unchanged).
• timeout-minutes present (unchanged).
• persist-credentials: false on read-only checkout (unchanged).
• No ${{ inputs.* }} inside run: — values pass through env:.
• catalog/capabilities.yml updated (risk note + last_verified).
• catalog/tools.yml updated (upload-artifact used_by adds coverage-gate).
• docs/generated/* regenerated (no matrix drift).
• CHANGELOG.md updated under [Unreleased] -> ### Added.
• Commits signed (-S) and signed off (-s).

Validation note

python3 scripts/validate_all.py reports only the two pre-existing failures on
main (pinned-actions and catalog, both from clusterfuzzlite/rust-supply-chain
PRs #68/#69 and unrelated to this change). coverage-gate.yml is unverified
in runtime-coverage (no proven digest), so editing it triggers no runtime-coverage
gate. This PR adds no new failures.