[codex] Add coverage and mutation gates

[jmcte]

Summary

• Adds a source coverage reporting gate to the fast CI path.
• Adds a dependency-free mutation smoke check for representative CLI/parser/probe behaviors.
• Adds focused regression coverage for help/version parsing and HTTP Safari tab parsing so the mutation smoke has real behavioral teeth.

Governing Issue

Refs #4

Validation

• Relevant local checks passed
• Required PR checks are expected to satisfy CI Gate
• Skipped checks are explained below

Validated with:

env CLANG_MODULE_CACHE_PATH=/private/tmp/icloud-cli-pr-worktree/.build/module-cache SWIFTPM_MODULECACHE_OVERRIDE=/private/tmp/icloud-cli-pr-worktree/.build/module-cache bash scripts/ci/run-fast-checks.sh

Result: passed. The run included CI policy checks, shell syntax checks, secret and fixture privacy checks, Swift tests, coverage reporting, mutation smoke, debug build, release build, and swift run icloud-cli --help.

Coverage evidence:

Source line coverage: 68.28% (minimum 68.00%)

Mutation evidence:

Mutation killed: drop-http-url-support
Mutation killed: drop-tab-title-text-rendering
Mutation killed: wrong-missing-cloud-tabs-failure-mode
Mutation killed: disable-help-shortcut

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

Flow Contract

• Owner lane: Codex implementation
• Repair owner: Codex
• Autonomy class: low-risk CI/test hardening
• Risk class: low; CI-only gate changes plus focused parser tests

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• PR author enabled auto-merge where GitHub allows it, or recorded why it is unavailable/unsafe

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

Notes

• Auto-merge was not enabled because this PR is opened as draft for review.
• The coverage floor is intentionally set to the current current-main source baseline plus enforcement. Raising it toward complete coverage should be done with follow-up tests for the broader inventory surfaces now on main.