Pin Rust coverage threshold to CI reality (96), drop its auto-ratchet

The Rust coverage check now passes the python3 parser (good), but it exposed a
phantom threshold: tarpaulin's line attribution is platform-divergent — macOS
reports 67/67=100% while Linux CI reports 66/68=97.1% for the SAME code (lines
like 'match name {' and struct-literal fields are attributed differently by the
host LLVM; the code is already exercised by existing tests). The 99% threshold
had been auto-ratcheted from the inflated macOS number, so CI could never meet it.

- coverage-thresholds.json: Rust threshold 99 -> 96 (floor(CI 97.1%)-1, matching
  the convention used by every other project's threshold).
- Makefile _coverage_check: make the Rust block CHECK-ONLY (no auto-ratchet
  write). Auto-ratcheting platform-divergent coverage captures the highest
  (macOS) measurement and pins an unmeetable CI threshold. F#/TS ratchets are
  unchanged (their coverage is platform-stable).

Verified: make _coverage_check -> all OK exit 0, and coverage-thresholds.json is
NOT mutated by a macOS run (no re-inflation). CI's 97.1% >= 96 passes.

Author: MelbourneDeveloper

Makefile

@@ -271,6 +271,12 @@ _coverage_check:
 	$(call _cov_check,src/Napper.Core.Tests,$(_FSHARP_COV)/report/Summary.txt,Napper.Core)
 	$(call _cov_check,src/DotHttp.Tests,$(_DOTHTTP_COV)/report/Summary.txt,DotHttp)
 	$(call _cov_check,src/Napper.Lsp.Tests,$(_LSP_COV)/report/Summary.txt,Napper.Lsp)
+	@# Rust is CHECK-ONLY — no auto-ratchet. tarpaulin's line attribution is
+	@# platform-divergent (macOS reports 67/67=100%; Linux CI reports 66/68=97.1%
+	@# for the SAME code — lines like `match name {` and struct-literal fields are
+	@# attributed differently by the host LLVM). Auto-ratcheting would capture the
+	@# inflated macOS number and set a threshold CI can never meet, so the Rust
+	@# threshold is pinned manually in coverage-thresholds.json to floor(CI%)-1.
 	@{ \
 	  t=$$(jq -r '.projects["src/Napper.Zed"].threshold // .default_threshold' coverage-thresholds.json); \
 	  if [ -f "$(_RUST_COV)/report/cobertura.xml" ]; then \
@@ -281,14 +287,7 @@ _coverage_check:
 	      echo "  *** FAIL: Rust coverage $${c}% is below threshold $${t}% — ABORTING ***"; \
 	      exit 1; \
 	    fi; \
-	    new_t=$$(( $$(echo "scale=0; $${c}/1" | bc) - 1 )); \
-	    if [ $$(echo "$${new_t} > $${t}" | bc -l) -eq 1 ]; then \
-	      tmp=$$(mktemp); \
-	      jq --argjson nt "$${new_t}" '.projects["src/Napper.Zed"].threshold = $$nt' coverage-thresholds.json > "$${tmp}" && mv "$${tmp}" coverage-thresholds.json; \
-	      echo "  RATCHET: Rust threshold -> $${new_t}%"; \
-	    else \
-	      echo "  OK"; \
-	    fi; \
+	    echo "  OK"; \
 	  else echo "  Rust: no data (skipping)"; fi; \
 	}
 	@{ \

coverage-thresholds.json

@@ -19,7 +19,8 @@
       "threshold": 98
     },
     "src/Napper.Zed": {
-      "threshold": 99
+      "_note": "Pinned manually (no auto-ratchet): tarpaulin line attribution is platform-divergent — macOS reports 100%, Linux CI reports 97.1% for identical code. Set to floor(CI%)-1.",
+      "threshold": 96
     }
   }
 }