Enforce coverage thresholds in CI (promote to required)

[osvaldoandrade]

Make coverage checks blocking in CI.

Current state:

• Coverage job is warn-only

Goal:

• Promote coverage job to required (blocks merge on regression)

Implementation:

• Update .github/workflows/ci.yml
• Change coverage job from continue-on-error: true to required
• Ensure .testcoverage.yml thresholds are met

Acceptance criteria:

• PR fails if coverage below 90% overall, 95% core, 80% storage
• Team aware of new gate

Part of: #654
Requires: All coverage gaps filled (controllers, middleware, raft)