fix(sovereign-ci): bin-only crates could never pass test or coverage

[noahgift]

The defect

Every branch of the test and coverage fallback chains passes --lib:

TEST_SCOPE: ${{ inputs.test_workspace && '--workspace --lib' || '--lib' }}

And cargo test --lib does not merely fail on a crate without a [lib] target — it errors:

error: no library targets found in package `cohete`   (exit 101)

So a bin-only repo had no reachable configuration. test_workspace only toggles --workspace; both of its values keep --lib.

Where it showed up

cohete's ci / coverage job, red for this and nothing else:

error: process didn't exit successfully: `cargo test ... --lib` (exit status: 101)
error: process didn't exit successfully: `cargo test ... --lib -p cohete` (exit status: 101)
::error::Coverage failed — check workspace path dependencies

Its CI last passed 2026-04-03, before this chain took its current shape.

The same --lib assumption independently made cohete's local pre-push hook unpassable — so every push there used --no-verify, and 84 rustfmt diffs plus 2 clippy errors accumulated behind the bypass (paiml/cohete#4). A gate that cannot pass is worse than no gate: it trains everyone to bypass it, and then real findings ride in behind the bypass.

The fix

One more link on each chain, without --lib. Covers bins, integration tests and doctests; works with or without a [lib].

Purely additive. A crate that has a lib target satisfies an earlier branch and never reaches the new line, so behaviour is unchanged for every repo that works today.

I verified the || \-with-comment chains still short-circuit correctly in both directions — fallback skipped when the prior command succeeds, run when it fails — rather than assuming either way.

⚠️ Review please — blast radius

This workflow is called by roughly 30 fleet repos. I am not self-merging it.

Refs PMAT-203.

🤖 Generated with Claude Code