test(cov): coverage drivers for never-measured surfaces (+ the 85% branch ceiling, measured) - #147

Four new C drivers plus six runner scripts aimed at the two largest
recoverable slices of the coverage gap documented in
test/coverage/FULL-COVERAGE-REPORT-3.md: the 515 never-called functions,
and the OOM error-return branches.

New drivers (test/c/cov_*.c, all single-process, SIGALRM-guarded):

* cov_api_surface.c (418 checks) -- the DB_ENV / DB / DBC / DB_TXN /
  DB_MPOOLFILE getter + callback-setter surface and the
  argument-validation / ENV_ILLEGAL_AFTER_OPEN halves of the setters.
  Targets the ~60 never-called getters in db_method.c (24),
  env_method.c (21), mp_fmethod.c (8) and db_cds.c (8): the Tcl
  bindings expose the setters a workload needs and never read a knob
  back, so every getter measured cold.

* cov_rep_api.c (254 checks) -- the replication + repmgr configuration
  and query surface: rep_get_config/limit/nsites/priority/request/
  timeout/clockskew, rep_set_clockskew/request/nsites, txn_applied, the
  DB_SITE handle methods, repmgr_get_ack_policy/config/local_site/
  site_by_eid, the channel *_inval stubs, and the base-API-vs-repmgr
  cross-rejection branches no Tcl rep test reaches (each picks one API
  and stays).

* cov_logrec_print.c (5115 checks) -- generates a log holding 41
  DISTINCT record kinds (hash contract/metagroup, queue extent
  create+delete, page truncation, compaction realloc, heap ops,
  off-page dups, cursor adjust under a child txn, subdb create,
  transactional rename/remove, DIAGNOSTIC, a prepared txn), then walks
  it through BOTH per-record dispatch tables: db_printlog
  (the ~39 *_autop.c printers) and db_log_verify (62 of
  log_verify_int.c's 99 functions -- the largest never-called count in
  the tree). One workload, two cold surfaces.

* cov_oom_paths.c -- a COVERAGE-oriented OOM sweep. fi_sweep.c is the
  bug-finding sweep and its children _exit(), which skips gcov's atexit
  flush, so its 947 failure points contribute ZERO measured coverage.
  This sweeps the same __os_* seam with a breadth-first workload and
  calls __gcov_dump() in each child before _exit. 6,016 of report #3's
  38,998 missing branches sit on `if ((ret = f()) != 0)` lines.
  Requires --enable-faultinject; SKIPs cleanly without it.

New runners for tiers that already existed and passed but that no
coverage driver had ever run, so what they cover always measured cold:

* run_cov_cutest.sh -- the 12-suite CuTest binary, one suite per
  process. TestChannel brings up three live repmgr sites and drives the
  whole DB_CHANNEL API, which is exactly repmgr_method.c's
  never-called set.
* run_cov_fuzz_corpus.sh -- the committed corpus + crash seeds replayed
  through FUZZ_STANDALONE harnesses against THIS build (run.sh and
  check-crashes.sh build their own ASan libdb, so the corrupt-input
  rejection branches were never counted).
* run_cov_dst.sh -- the 41 DST scenarios; SKIPs when the library lacks
  --enable-dst.

test/coverage/full_run4.sh is a portable rework of
full_run3_combined.sh: repo root derived from the script location,
tcl/gcov/lcov from the environment, PHASE 1 throttled to $COV_PAR so
the run survives an 8-way box, --enable-dst + --enable-faultinject added
(both additive and inert until armed), and PHASE 2 folds in
recd_handlers (which report #3 recorded as a measurement gap) plus all
the tiers above. SKIP_PHASE1/SKIP_PHASE2/PHASE2_ONLY_NEW allow adding
to an existing .gcda accumulation, which is how per-batch deltas are
measured.

Measurement only -- no engine source touched. Five engine/harness
findings surfaced while validating these drivers and are written up in
the report, not fixed here.