SEP-996: Show coverage evolution in PR coverage report comments (#546)

- Adds `.github/workflows/coverage-main.yml` that runs the test suite on
pushes to `main` and invokes
`py-cov-action/python-coverage-comment-action`, so main-branch coverage
JSON gets committed to the `python-coverage-comment-action-data` branch.
Permissions follow least-privilege: the workflow defaults to `contents:
read` and only the `store-coverage` job elevates to `contents: write`.
- Subsequent PR coverage comments will render the evolution badge (e.g.
`83% → 84%`) instead of `"Previous coverage rate is not available,
cannot report on evolution"`.
- Reuses the existing `setup-python-job` composite action and the same
action SHA (v3.40) already pinned in `python.yaml`. The existing PR-side
two-workflow pattern is untouched.

Author: yyyyyyyan

.github/workflows/coverage-main.yml

@@ -0,0 +1,40 @@
+# Store main-branch coverage data so PR coverage comments can display
+# evolution (old% -> new%). The py-cov-action commits coverage JSON to
+# the python-coverage-comment-action-data branch on pushes to main, and
+# subsequent PR runs read from it to compute the delta.
+
+name: Coverage (main)
+
+on:
+  push:
+    branches:
+    - main
+
+permissions:
+  contents: read
+
+jobs:
+  store-coverage:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python-job
+        with:
+          python-version: "3.11.9"
+          cache: poetry
+
+      - name: Install test dependencies
+        run: poetry install --with syncmysql
+
+      - name: Run tests
+        run: make test
+
+      - name: Store coverage data on data branch
+        uses: py-cov-action/python-coverage-comment-action@7188638f871f721a365d644f505d1ff3df20d683 # v3.40
+        with:
+          GITHUB_TOKEN: ${{ github.token }}