feat: per-package coverage floor, and a fuzz corpus that persists

[Jaro-c]

Two changes, both from decisions taken on Glyndor/authcore#218 and #225.

go-ci: an optional per-package coverage floor

An aggregate threshold on a module whose packages differ in risk rewards covering the easy ones. authcore ran at 91% against a gate of 90 while its OIDC client sat at 87.7% and the package that persists its Ed25519 keys at 85.7% — the two with the most attack surface were the two thinnest, paid for by a fully covered clock helper.

per-package-coverage-threshold defaults to 0, so no existing caller changes behaviour until it opts in.

Measured before assuming it was worth having: comparing isolated profiles against -coverpkg=./... moves those packages by +0.5 and +0.0, so the per-package numbers are honest rather than an artefact of helpers being exercised from a sibling package. Had that not held, the gate would have been enforcing noise.

The awk was dry-run against authcore's real profile and reproduces go test -cover exactly:

90.2 github.com/Glyndor/authcore/auth/oauth
91.9 github.com/Glyndor/authcore/auth/email
92.0 github.com/Glyndor/authcore/internal/keymanager
...
100.0 github.com/Glyndor/authcore/internal/clock

LC_ALL is pinned because awk formats decimals per locale, and a comma separator would truncate the comparison at the boundary — it did on my machine.

go-fuzz: the corpus persists between runs

Short fuzz runs are only worth repeating if they add up, and these did not. setup-go restores GOCACHE — where Go keeps the corpus — but on a cache hit it does not save it again:

Cache hit occurred on the primary key setup-go-…, not saving cache.

So everything a run discovered died with the runner, and the next week re-explored the same ground from the seed corpus. The key derives from go.sum as well, which a dependency bump changes, so even the accidental persistence reset every few days.

Measured on authcore before touching it: a cold 60s run of FuzzParseJWK finds 219 new interesting inputs; 300s finds 293. A single run saturates well before its budget — the budget is not the constraint, starting from zero every week is. That is also why fuzztime is left alone.

The corpus now has a key of its own, per target, with the run id in it so it never hits and is therefore always saved; restore-keys pulls the most recent one back. The path comes from go env GOCACHE rather than an assumed default.

Not tagged yet

Same rule as v1.11.0: a consumer proves these green before they get a version. authcore adopts both next, and I will cut the tag once its pull request is green.