chore: coverage + Go Report Card badges and a threat-model section

[JumpTechCode]

Repo-credibility polish for discoverability and reviewer trust.

Changes

• Badges. Add Codecov coverage and Go Report Card badges to the README header (alongside the existing ci/codeql badges).
• CI. Upload coverage to Codecov from the build & test job using the tokenless OIDC flow (codecov/codecov-action@v5, use_oidc: true, id-token: write). fail_ci_if_error: false, so an upload hiccup never reds CI. Wired to the coverage.out profile scripts/coverage.sh already produces.
• Threat model. New README section after Security model: trust boundaries (client ↔ gateway ↔ downstream), what each position can/cannot do, assumptions, and security non-goals — all cross-referencing the existing Security model and Scope sections and their ADRs. No new behavior claims.

Notes

• The Codecov badge reads "unknown" until the first main build uploads coverage after merge — expected for a first integration.
• Tokenless Codecov on public repos can occasionally rate-limit; if uploads get flaky later, adding a CODECOV_TOKEN repo secret resolves it. No token is required to merge this.

🤖 Generated with Claude Code