ci: fail the coverage gate when it verified nothing

.github/workflows/ci-lite.yml

@@ -151,6 +151,10 @@ jobs:
               # entry, resolved to `["rust-tauri"]` alone, skipping every lane
               # that would have compiled the family it enabled.
               - 'scripts/ci/product-features.*'
+              # The coverage-presence gate and its allowlist decide whether this
+              # lane FAILS, so they arm it for the same reason.
+              - 'scripts/ci/assert-coverage-presence.sh'
+              - 'scripts/ci/coverage-presence-allowlist.txt'
               - 'Cargo.toml'
               - 'Cargo.lock'
               - 'build.rs'
@@ -180,6 +184,8 @@ jobs:
               # changes what compiles, which invalidates per-module scoping
               # exactly as a `Cargo.toml` change does.
               - 'scripts/ci/product-features.*'
+              - 'scripts/ci/assert-coverage-presence.sh'
+              - 'scripts/ci/coverage-presence-allowlist.txt'
               - 'Cargo.toml'
               - 'Cargo.lock'
               - 'build.rs'
@@ -222,6 +228,8 @@ jobs:
               - 'scripts/mock-api/**'
               - 'scripts/*.mjs'
               - 'scripts/__tests__/**'
+              # Bash helpers with node --test coverage in scripts/__tests__/.
+              - 'scripts/ci/assert-coverage-presence.sh'
             # Test-wiring surface: a change here can orphan a test or add an
             # untested controller domain → run the inventory guard.
             inventory:
@@ -1207,7 +1215,29 @@ jobs:
             --compare-branch="${{ steps.coverage-compare.outputs.ref }}" \
             --fail-under=80 \
             --html-report diff-coverage.html \
-            --markdown-report diff-coverage.md
+            --markdown-report diff-coverage.md \
+            --format json:diff-coverage.json
+
+          # diff-cover exits 0 when it measured nothing at all ("No lines with
+          # coverage information in this diff"), which is how PR #5593 passed
+          # this gate with 1,643 uncompiled lines. Absence of data is not
+          # evidence of coverage — but it IS legitimate for a diff whose only
+          # Rust/TS changes are comments, imports or type declarations, so this
+          # only WARNS. The hard failure for "the file was never compiled" is
+          # scripts/ci/assert-coverage-presence.sh, which runs inside the core
+          # coverage lane and can tell those two cases apart.
+          #
+          # `total_num_lines` is diff-cover's own count of changed lines it
+          # found coverage rows for: 0 on the "no lines with coverage
+          # information" path, non-zero otherwise. Verified against
+          # diff-cover 10.5.1 (the version `>=9.2.0` resolves to today) on both
+          # an empty and a non-empty diff. `--format json:` rather than the
+          # `--json-report` alias, which that release deprecates.
+          measured="$(python3 -c 'import json; print(json.load(open("diff-coverage.json"))["total_num_lines"])')"
+          echo "diff-cover measured ${measured} changed line(s)"
+          if [ "${measured}" -eq 0 ]; then
+            echo "::warning::diff-cover measured 0 changed lines. If this PR changed executable code, that code was not compiled by any coverage lane — check the 'Rust Core Coverage' log for the coverage-presence gate."
+          fi
 
       - name: Upload diff-cover report
         if: always() && needs.changes.outputs.coverage == 'true'