install ratcheting line-coverage gate at 34% floor (T-90)

First child of T-89. Codifies "don't make coverage worse" as a
durable pre-push contract before any test-writing children land.

- pubspec.yaml: new `coverage_floor: 34` key. Single source of
  truth for the floor; ratchets up only.
- ci/coverage_gate.sh: parses coverage/lcov.info (LH/LF), reads
  the floor from pubspec.yaml, exits non-zero if integer-truncated
  measured % drops below it. Self-contained awk parser — no `lcov`
  CLI dependency.
- ci/test.sh: flutter test now runs with --coverage, so the gate
  reads fresh data without an extra test invocation. Wall time
  delta is small and stays inside the < 90 s pre-push budget
  (D-29).
- Makefile: new `coverage-gate` target wires the script in;
  `push-check` adds it as a dependency. The .githooks/pre-push
  hook (already wired) picks this up automatically.
- .gitignore: ignore /coverage/ wholesale; the floor lives in
  pubspec.yaml, nothing under coverage/ is committed.

Decision recorded as D-66 (decisions/testing.md). End target is
95%; reaching it is tracked as the rest of T-89's children.

Co-Authored-By: Claude <noreply@anthropic.com>

Makefile

@@ -106,6 +106,10 @@ test-all: test-core test test-a11y test-integration test-e2e ## Everything, sequ
 coverage: ## flutter test --coverage + lcov summary.
 	ci/test_coverage.sh
 
+.PHONY: coverage-gate
+coverage-gate: ## Coverage gate — fails if total line % < coverage/floor.txt (D-66). Assumes `make test` ran first.
+	ci/coverage_gate.sh
+
 .PHONY: smoke-bundle
 smoke-bundle: ## Build Linux release bundle and run it under xvfb for 5s.
 	ci/smoke_bundle.sh
@@ -276,7 +280,7 @@ decisions-validate: ## Parser dry-run over decisions/*.md.
 	pql decisions validate
 
 .PHONY: push-check
-push-check: decisions-validate test-core test test-a11y ## Pre-push gate.
+push-check: decisions-validate test-core test test-a11y coverage-gate ## Pre-push gate.
 
 .PHONY: hooks
 hooks: ## Install the repo's git hooks.