Guard unset CRITICAL_PREFIXES in coverage config

[negillett]

Summary

• Use ${#CRITICAL_PREFIXES[@]:-0} so incomplete coverage-tiers.conf fails with the existing descriptive error instead of an unbound-variable crash under set -u
• Add scripts/check-coverage_config_test.sh regression test

Follow-up to merged #7 (Bugbot low-severity review on tools #88).

Test plan

• bash scripts/check-coverage_config_test.sh
• bash scripts/run-coverage-gate.sh

[cursor]

PR Summary

Low Risk
CI/coverage script validation only; no runtime product or security impact.

Overview
Hardens critical-tier config validation in check-coverage.sh when coverage-tiers.conf sets CRITICAL_MIN but omits or leaves empty CRITICAL_PREFIXES. Instead of referencing an unset array under set -u, the script now checks that CRITICAL_PREFIXES is defined and non-empty before building rules; otherwise it exits with the existing message requiring CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES.

Adds scripts/check-coverage_config_test.sh to assert exit code 2 and that message for configs with only TOTAL_MIN or CRITICAL_MIN without prefixes.

^{Reviewed by Cursor Bugbot for commit d9f5de7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 917afbd. Configure here.}