test(coverage-report): cover collect()'s merge and record-skip paths

[hivecommons-hive]

Test Improvement

Adds tests/coverage-report-collect.test.mjs — the first direct test of
collect() in tests/tools/coverage-report.mjs.

collect() reads the raw NODE_V8_COVERAGE dump, folds each sandbox URL back
onto the real source tree, and merges every process's record for a file into one
per-offset count map. --check, --check-regions, --check-source and
--check-source-regions all score exactly what it returns.

It had no direct test, and its own execution is structurally invisible to the
report it produces: the reporter runs collect() in the parent process and
sets NODE_V8_COVERAGE only for the node --test child it spawns. So a
regression in the merge would not fail anything — it would silently move the
published percentage.

What the 12 tests pin

• the per-offset max merge: two records that each leave a different half of a
  file unexecuted merge to fully covered
• a later zero-count record never lowers a count an earlier record recorded
• the higher of two non-zero counts wins
• a sandbox copy's URL folds onto the real source path
• non-.json directory entries are ignored even when they contain valid
  coverage JSON, so the extension filter cannot hide behind the
  malformed-file fallback
• a malformed coverage file is skipped rather than aborting the whole run
• a record whose file is gone from disk is skipped, and is not reported as
  unmapped
• a record for a path outside the repository is ignored
• a record whose offsets address loader-generated text is reported as unmapped
• a file stops being reported as unmapped once any record maps onto it
• the merged entry carries the source text alongside its counts
• an unusable coverage directory yields an empty result rather than throwing

Each test builds its own coverage directory and fake repository root under
os.tmpdir() and removes it afterwards, so nothing depends on what the real
suite happens to execute.

Verification

Measured on a clean npm ci at b54cf81:

	before	after
tests/tools/coverage-report.mjs lines	96.21%	97.53%
tests/tools/coverage-report.mjs regions	93.10%	95.42%
all files (lines / regions)	99.09% / 93.34%	99.13% / 93.46%

Previously-unexecuted lines 437-438, 447-448 and 470-473 are now covered.

Mutation-checked, so the tests are not vacuous. All four of these mutants
survive on main and are killed by this PR:

Mutation	Killed by
if (counts[i] > existing.counts[i]) existing.counts[i] = counts[i]; → existing.counts[i] = counts[i];	3 tests
if (!entry.endsWith('.json')) continue; → removed	1 test
for (const relPath of merged.keys()) unmapped.delete(relPath); → removed	1 test
unmapped.add(relPath); → removed	1 test

npx prettier --check and npx cspell both pass on the new file. No production
code, no existing test, and no shared helper is touched — the diff is one new
file under tests/.

Disjointness

This claims tests/coverage-report-collect.test.mjs and the collect() function
in tests/tools/coverage-report.mjs. No open PR touches either: #674 changes
package.json only, #678 claims tests/helpers-import-sandbox.mjs, #693 claims
tests/helpers-script-sandbox.mjs, and #680, #686, #688, #676, #684, #691 claim
unrelated validator, collector and security files.

Related Issue

Closes #701

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.