ci: coverage floor + gate; CI never ran a single test before this (F64)

Delivery plan Q9: "set a justified coverage floor and CI gate. Deliberately
unset today." Both parts of that were still true - karma.conf.js had no
check thresholds, and architecture-governance.yml built and checked
boundaries but never invoked `ng test` at all.

Floor set 5 points below the measured level right after this session's
facade-test pass (43.3%/29.0%/34.1%/43.7% statements/branches/functions/
lines): 40/25/30/40. A deliberate floor, not an aspiration - meant to be
ratcheted up as coverage grows, and to fail a PR that drops below it
rather than silently accept a lower number.

Verified the gate actually fails, not just logs a warning: set
statements to an impossible 99% locally, confirmed `npm run test:coverage`
exits 1 (my first attempt at this check was wrong - piping through `tail`
meant the $? I read back was tail's exit code, not npm's; fixed by
capturing it directly). Restored the real floor and confirmed a clean
exit 0 before committing.

CI changes: added the Setup Chrome + coverage-gated test step
karma.conf.js's CHROME_BIN needs (its fallback is a Windows path, useless
on ubuntu-latest), plus an E2E step. Structurally verified locally (no
tabs, step count, manual read-through) - a real GitHub Actions run on
Anthropic's infrastructure could not be executed from this session, so
this is not confirmed end-to-end the way the coverage gate itself was.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/architecture-governance.yml

@@ -26,5 +26,24 @@ jobs:
       - name: Enforce Boundaries
         run: npm run arch:check
 
+      # Was entirely missing before 2026-08-18: this workflow built and
+      # checked boundaries but never ran a single test. karma.conf.js's
+      # CHROME_BIN fallback is a Windows path, which the ubuntu-latest
+      # runner doesn't have - browser-actions/setup-chrome supplies one
+      # and CHROME_BIN below points at it explicitly.
+      - name: Setup Chrome
+        id: setup-chrome
+        uses: browser-actions/setup-chrome@v1
+
+      - name: Unit tests with coverage gate
+        env:
+          CHROME_BIN: ${{ steps.setup-chrome.outputs.chrome-path }}
+        run: npm run test:coverage
+
       - name: Build
         run: npm run build
+
+      - name: E2E
+        run: |
+          npx playwright install --with-deps chromium
+          npm run e2e

karma.conf.js

@@ -26,6 +26,20 @@ module.exports = function (config) {
       dir: require('path').join(__dirname, 'coverage'),
       subdir: '.',
       reporters: [{ type: 'text-summary' }, { type: 'html' }, { type: 'lcovonly' }],
+      // Floor set 2026-08-18, ~5 points below the measured level right
+      // after this session's facade-test pass (43.3%/29.0%/34.1%/43.7%
+      // statements/branches/functions/lines) - a deliberate floor per the
+      // delivery plan's Q9 ("deliberately unset today"), not an aspiration.
+      // Ratchet this UP as coverage grows; a PR that drops below it should
+      // fail CI, not get merged with a lower number quietly re-baselined in.
+      check: {
+        global: {
+          statements: 40,
+          branches: 25,
+          functions: 30,
+          lines: 40,
+        },
+      },
     },
     restartOnFileChange: true,
   });