ci(#310): scope release and hotfix gates to unit coverage (#388)

release.yml (rc + finalize) and hotfix.yml (finalize) ran the full
`npm run test:coverage` suite on the release path, redundantly re-running
the integration/install/security/slow suites that already passed on the
PR lanes into next. Switch those three sites to `npm run test:coverage:unit`
(same c8 config, unit suite only) to cut release latency. Full-suite
coverage remains available via the dedicated lanes / `test:coverage:all`.

Adds a workflow-contract regression test asserting the release/hotfix gates
invoke the unit coverage command (exact-line match, not substring).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/hotfix.yml

@@ -320,7 +320,7 @@ jobs:
       - name: Install and test
         run: |
           npm ci
-          npm run test:coverage
+          npm run test:coverage:unit
 
 
       - name: Dry-run publish validation

.github/workflows/release.yml

@@ -191,7 +191,7 @@ jobs:
           npm ci
           chmod +x scripts/check-npm-integrity.sh
           scripts/check-npm-integrity.sh
-          npm run test:coverage
+          npm run test:coverage:unit
 
       - name: Commit pre-release version bump
         env:
@@ -324,7 +324,7 @@ jobs:
           npm ci
           chmod +x scripts/check-npm-integrity.sh
           scripts/check-npm-integrity.sh
-          npm run test:coverage
+          npm run test:coverage:unit
 
       - name: Ensure npm supports trusted publishing
         run: npm install -g npm@latest

tests/release-coverage-scope.test.cjs

@@ -0,0 +1,35 @@
+// allow-test-rule: source-text-is-the-product
+// .github/workflows/{release,hotfix}.yml are the deployed CI contract; asserting
+// the release-gate test command is only expressible against the workflow text.
+
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const RELEASE_WORKFLOW = path.join(__dirname, '..', '.github', 'workflows', 'release.yml');
+const HOTFIX_WORKFLOW  = path.join(__dirname, '..', '.github', 'workflows', 'hotfix.yml');
+
+describe('release-coverage-scope', () => {
+  test('release.yml uses test:coverage:unit (not full suite) in both rc and finalize gates', () => {
+    const lines = fs.readFileSync(RELEASE_WORKFLOW, 'utf8').split('\n').map(l => l.trim());
+    const bareCount = lines.filter(l => l === 'npm run test:coverage').length;
+    const unitCount = lines.filter(l => l === 'npm run test:coverage:unit').length;
+    assert.strictEqual(bareCount, 0,
+      `release.yml still has ${bareCount} bare 'npm run test:coverage' line(s); expected 0`);
+    assert.strictEqual(unitCount, 2,
+      `release.yml has ${unitCount} 'npm run test:coverage:unit' line(s); expected 2`);
+  });
+
+  test('hotfix.yml uses test:coverage:unit (not full suite) in the finalize gate', () => {
+    const lines = fs.readFileSync(HOTFIX_WORKFLOW, 'utf8').split('\n').map(l => l.trim());
+    const bareCount = lines.filter(l => l === 'npm run test:coverage').length;
+    const unitCount = lines.filter(l => l === 'npm run test:coverage:unit').length;
+    assert.strictEqual(bareCount, 0,
+      `hotfix.yml still has ${bareCount} bare 'npm run test:coverage' line(s); expected 0`);
+    assert.strictEqual(unitCount, 1,
+      `hotfix.yml has ${unitCount} 'npm run test:coverage:unit' line(s); expected 1`);
+  });
+});