feat(cli): add --min-coverage threshold

[rodboev]

Summary

Added --min-coverage FLOAT as an opt-in CLI gate over the existing canonical coverage percentage. A below-threshold scan exits 1 after writing its normal report.

Changes

• Validate finite thresholds in the CLI's existing option framework.
• Use strict less-than semantics, so equality passes.
• Apply the same policy to single scans, each recursive child, and the recursive aggregate scope.
• Fail closed when enabled coverage is missing or non-numeric, while preserving execution and existing gate precedence.

Preserved

Default behavior, --fail-on-incomplete, risk scoring and recommendation, output schemas, ledger coverage computation, and registry-mode boundaries remain unchanged.

Validation

Focused CLI tests cover threshold boundaries, recursive children and aggregate scope, invalid values, output-before-exit, missing coverage, precedence, and schema preservation. Verification completed: 112 passed, ruff check passed, ruff format --check passed, and git diff --check passed.

Related

Closes #389. PR #393 supplies the separate --fail-on-incomplete behavior.

[rng1995]

[SkillSpector Review]\n\nApproved. The coverage threshold validates finite values in range, fails closed on absent or non-numeric coverage, uses strict less-than semantics, and composes correctly with recursive and existing exit-code behavior. Current required checks pass.