ci: add coverage gate and semgrep to CI workflow

[okwn]

Summary

Adds two CI safety gates to the contracts repository:

Coverage Gate

• Runs just coverage-lcov to generate lcov.info
• Checks that line coverage is >= 70%
• Prevents coverage degradation from being merged

Semgrep CI Step

• Adds returntocorp/semgrep-action@v1 as a blocking CI step
• Runs with p/security-audit p/severity-high rulesets
• Blocks merge if high-severity security issues found

Justfile Fix

• Fixed semgrep target to scan ./src instead of non-existent ./packages/contracts-bedrock path

Why Safe

• Coverage gate is informational — only fails if coverage drops below 70%
• Semgrep uses pre-built rulesets, no custom rules added
• No production code changed, only CI configuration

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2