ci: enforce the coverage floor per package, and keep the fuzz corpus

[Jaro-c]

Closes #218. Closes #225. Adopts both halves of Glyndor/.github#106, and is the consumer that proves them before that repository gets a tag.

Per-package coverage floor

This module ran at 91% against a gate of 90 while auth/oauth sat at 87.7% and internal/keymanager at 85.7%. The two with the most attack surface were the two thinnest, and internal/clock at 100% was paying for them.

Every package clears 90 today, which is exactly when a floor is cheapest to adopt — it locks in a state that already holds rather than demanding new work:

package	coverage
auth/oauth	90.2%
auth/email	91.9%
internal/keymanager	92.0%
auth/apikey	94.6%
auth/jwt	95.0%
auth/password	95.8%
auth/username	97.5%
authcore	98.1%
internal/clock	100.0%

The measurement that made this decidable: comparing isolated profiles against -coverpkg=./... moves those packages by +0.5 and +0.0, so the per-package numbers are honest rather than an artefact of helpers being exercised from a sibling package.

The fuzz corpus survives between runs

It never did. setup-go restores GOCACHE — where Go keeps the corpus — but on a cache hit does not save it again, so every discovery died with the runner and the next week re-explored the same ground from the seeds.

Measured here before changing anything: a cold 60s run of FuzzParseJWK finds 219 new interesting inputs, 300s finds 293. A single run saturates well before its budget, so the budget was never the constraint — starting from zero every week was. fuzztime is deliberately unchanged.

The compounding will not be visible in this pull request; the first scheduled run after it merges seeds the cache, and the one after that is the first to start warm.

Pinned by SHA

Glyndor/.github is only tagged once a consumer has proved a workflow green, and this is that consumer. The pin moves to the release tag afterwards.

[Jaro-c]

Proved the gate can fail before trusting it, since a gate nobody has seen fail is decoration.

Temporarily raised the floor to 96 on this branch (f1323f4) and the job went red, naming each package individually:

::error::github.com/Glyndor/authcore/auth/oauth is at 90.2%, under the 96% floor
::error::github.com/Glyndor/authcore/auth/email is at 91.9%, under the 96% floor
::error::github.com/Glyndor/authcore/internal/keymanager is at 92.0%, under the 96% floor
::error::github.com/Glyndor/authcore/auth/apikey is at 94.6%, under the 96% floor
::error::github.com/Glyndor/authcore/auth/jwt is at 95.0%, under the 96% floor

Reverted to 90 in 382807a, and the job is green again with Every package clears 90%. So the wiring propagates the exit status, the if: condition fires, and the annotation points at the offender rather than just failing.

This is the same discipline the sweep in #229 was about: the failing direction is the one worth checking.