enhancement: Add CI coverage reporting and Dependabot configuration

[jflowers]

Summary

CI does not report test coverage or enforce coverage thresholds. Additionally, no automated dependency update mechanism is configured.

Missing Coverage Reporting

• CI runs go test -v -race ./... but does not generate or report coverage
• Makefile has test-coverage target but CI never uses it
• AGENTS.md lists "coverage thresholds and CRAP scores" as protected gates, but none exist

Missing Dependency Automation

• No .github/dependabot.yml or renovate.json exists
• Go module and GitHub Actions dependency updates are entirely manual

Fix

Coverage

Add -coverprofile=coverage.out to the CI test step and optionally upload to a coverage service or enforce a minimum threshold.

Dependabot

Create .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: gomod
    directory: /
    schedule:
      interval: weekly
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
  - package-ecosystem: npm
    directory: /browser
    schedule:
      interval: monthly

Priority

MEDIUM — Improves visibility into test quality and keeps dependencies current.