fix(QUAL-009): bring app.py into the coverage gate

[DoRmAmMu1997]

Closes #120.

Problem

The gate measured --cov=backend --cov=screeners --cov=ui, so the 927-line Streamlit entrypoint contributed nothing to the 89% floor — despite roughly 14 tests/test_app_*.py modules actively exercising it. Coverage could regress in app.py without CI noticing, which is the exact failure the floor exists to prevent.

The floor did not need re-baselining

This is the useful finding, and it is why the diff is small:

	Statements	Missed	Coverage
app.py alone	290	69	76%
Total, before	16,297	1,634	89.97%
Total, after	16,587	1,706	89.71%

89.71% still clears the 89 floor with 0.71pp of headroom — which matches the "~0.7pp" figure AGENTS.md already documents. So the floor number is untouched, and this PR is one flag in six files rather than a floor change nobody asked for.

(Amusingly, AGENTS.md claimed "measured ~89.7%" while the real figure was 89.97%. Including app.py makes that sentence accurate again.)

Note on the spelling

--cov=app.py makes pytest-cov abort outright. The module name --cov=app is what works, and is what landed.

Files kept in sync

Per AGENTS.md §7, changing a CI command means co-updating everything that mirrors it, in the same commit:

• .github/workflows/quality-and-security.yml:52
• AGENTS.md §6, README.md, docs/operations.md, docs/adding-a-screener.md
• all three assertions in tests/test_supply_chain_policy.py (the CI_COMMANDS tuple plus the workflow and README checks)

AGENTS.md also gains a short note on what is measured and what is not: Dependencies/ (an interactive credential helper) and migrations/ (hand-written, covered by the Alembic drift guard instead) stay out on purpose.

The three *-handoff.md docs still quote --cov-fail-under=84. Those are point-in-time ticket handoffs, so they are left as the historical record they are — same treatment as the audit register.

Deliberately not included

The --strict-markers rider I suggested on the issue. Its premise was "if a [tool.coverage.run] section is being added anyway" — it is not, because --cov=app needs no coverage config at all. Keeping pyproject.toml untouched preserves the empty §7 pin diff for this branch. It is worth its own small ticket: there is still no [tool.pytest.ini_options], so a typo'd @pytest.mark.slwo would silently do nothing.

Verification

• pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 — 2034 passed, 1 skipped, 89.71%
• ruff check, compileall — clean
• tests/test_supply_chain_policy.py — 13 passed against the new command strings
• git diff origin/main HEAD -- constraints.txt pyproject.toml — empty

🤖 Generated with Claude Code