ci(coverage): parse lcov instead of forge's ASCII table

[rubydusa]

Closes #44.

Summary

Switch `forge coverage` to `--report lcov` and parse lcov in `extract-summary.sh`. lcov is a stable, well-documented format; forge's ASCII table changes across versions and was a latent breakage risk for every consumer repo.

Trade-offs

• Drops the separate "Statements" metric. lcov has no equivalent — it tracks lines, branches, and functions only. The `stmts_pct` step output is now set equal to `lines_pct` so `check-threshold.sh` (which checks all four) still works without changes.
• Replaces `coverage-source-filter` with `coverage-source-prefix`. Old: grep substring against an ASCII table row. New: path prefix matched against lcov `SF:` records. Default changes from `' src/'` (with leading space, to disambiguate `/src/`) to `'src/'`. Breaking change for any consumer that overrode this input — they'll need to update.

Files

• `scripts/coverage/extract-summary.sh` — rewritten around an awk pass over lcov.
• `_ci.yml` and `_foundry-cicd.yml` — invoke `forge coverage --report lcov`, pass new env var.
• `tests/fixtures/coverage.lcov` — new fixture (replaces `coverage-raw.txt`).
• `tests/test-extract-summary.sh` — adapted, plus two new tests (empty-filter, missing-lcov).
• README updated.

Test plan

• All 27 unit tests pass (was 25 — added 2 in this PR).
• ShellCheck clean.
• YAML validates.
• CI green.
• Smoke test in a consumer repo to confirm `forge coverage --report lcov` writes `lcov.info` to the working directory under recent Foundry stable.

Note on rollout order

This is the most behavior-changing PR of the five. If we land #45 (SHA pin) and #50 (foundry-version=stable) first, this PR runs against a known-good Foundry version and the lcov format is locked.

🤖 Generated with Claude Code