Adopt tiered coverage gates

[negillett]

Summary

• Move enforcement from pytest --cov-fail-under=95 to tiered check-coverage.sh
• 90% total and 95% on intentproof/ package

Test plan

• bash scripts/run-coverage-gate.sh

[cursor]

PR Summary

Low Risk
Changes only test/coverage tooling and CI steps; no runtime SDK or security behavior.

Overview
Replaces the flat 95% pytest/coverage fail-under with tiered gates: 90% total and 95% on the intentproof/ package surface, configured in scripts/coverage-tiers.conf and documented in scripts/README-coverage-tiers.md.

check-coverage.sh now reads coverage.json, applies total and per-prefix critical rules, uses integer statement math for pass/fail (with truncated display so UI cannot round up past a failure), and fails if a critical prefix matches no statements.

run-coverage-gate.sh runs pytest, emits coverage.json, then invokes the tier checker—used in CI and release workflows instead of separate pytest + check-coverage.sh 95 steps. pyproject.toml drops fail_under and --cov-fail-under. Small bash regression tests cover path resolution, display vs gate semantics, and missing critical prefixes.

^{Reviewed by Cursor Bugbot for commit b0bc499. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dfb63cf. Configure here.}