install ratcheting line-coverage gate at 34% floor (T-90)

First child of T-89. Codifies "don't make coverage worse" as a
durable pre-push contract before any test-writing children land.

- pubspec.yaml: new `coverage_floor: 34` key. Single source of
  truth for the floor; ratchets up only.
- ci/coverage_gate.sh: parses coverage/lcov.info (LH/LF), reads
  the floor from pubspec.yaml, exits non-zero if integer-truncated
  measured % drops below it. Self-contained awk parser — no `lcov`
  CLI dependency.
- ci/test.sh: flutter test now runs with --coverage, so the gate
  reads fresh data without an extra test invocation. Wall time
  delta is small and stays inside the < 90 s pre-push budget
  (D-29).
- Makefile: new `coverage-gate` target wires the script in;
  `push-check` adds it as a dependency. The .githooks/pre-push
  hook (already wired) picks this up automatically.
- .gitignore: ignore /coverage/ wholesale; the floor lives in
  pubspec.yaml, nothing under coverage/ is committed.

Decision recorded as D-66 (decisions/testing.md). End target is
95%; reaching it is tracked as the rest of T-89's children.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -36,6 +36,11 @@ tools/ui/.serve.pid
 # -- dart doc output (generated by `dart doc`, uploaded as CI artefact) -
 /doc/
 
+# -- coverage output (regenerated by every `flutter test --coverage`).
+#    Floor lives in pubspec.yaml `coverage_floor:`; nothing under
+#    coverage/ is committed.
+/coverage/
+
 # -- Test, coverage, profile output ------------------------------------
 *.test
 *.out