0.8.0: raise meaningful boundary coverage and risk-group gates

[xeonvs]

Goal

Raise confidence at the toolkit trust boundaries without adding a coverage framework or refactoring production code for percentage alone.

Scope

• Add meaningful fault and adversarial tests at existing result, preflight, GitLab transaction, context, DLP, receipt, MCP, provider-neutrality, and approval owners.
• Keep one branch-aware pytest/coverage run and raise the combined floor from 70% to 85%.
• Add ordinary Coverage.py include reports for four risk groups: result/preflight 80%, GitLab posting transaction 80%, context/DLP/approval 85%, and MCP/providers/contracts 85%.
• Change production code only when a test demonstrates a real contract violation.
• Keep local and hosted coverage commands aligned.

Acceptance criteria

• Combined branch-aware coverage is at least 85%.
• Every locked risk group meets its floor.
• Boundary tests cover the plan matrix without fixture duplication or test-file reorganization.
• DLP rejection cannot enable approval, safe non-remediation context does not block approval, and admitted remediation remains comment-only.
• Provider-neutral code stays independent of GitLab and a non-GitLab fake provider satisfies the common contract.
• Local quality and hosted test jobs enforce the same coverage gates.
• A dedicated maintenance changelog fragment explains the 70% to 85% change and risk-group gates.

Parent: #120
Draft implementation: #122

[github-actions]

Stable v0.8.0 delivery is verified by immutable release asset release-receipt.json in v0.8.0 (SHA-256 1f2c06d197d78a2e1cdba7cafff0a0dd08cf67ced0f5c8ab4f833f0eb437dc6f).