Review coverage config and ratchet package coverage gates to 100%

[tpvasconcelos]

Summary

Follow-up review of #155 ("Review usage of covdefaults and .coveragerc"):

• covdefaults itself was already removed in the June 2024 coverage refactor (f39c672) — and notably, the plugin was never actually active (no plugins = covdefaults ever existed in .coveragerc), which also explains why sys.version_info blocks stopped being excluded back then.
• This PR adopts the remaining useful bits from covdefaults and ratchets the coverage gates to the current baseline, which is already at 100%:
  • .coveragerc: add ^\s*assert_never\b to exclude_lines; set skip_covered = true
  • tox.ini: raise tests-unit gate 95 → 100 and the combined-report gate 98 → 100
  • codecov.yml (new): make the Codecov 100% project/patch targets explicit in-repo (CI only uploads the combined report, which omits cicd_utils/* and tests/*, so these targets apply to src/ridgeplot only)
  • AGENTS.md: document the new policy — intentionally-untested lines must carry an explicit # pragma: no cover

Not adopted from covdefaults (with rationale): the platform/version pragma machinery (no gated code paths exist; this is the only part that genuinely requires the plugin), the */__main__.py/*/setup.py omits (none exist), and the source = . fallback (per-suite --cov targets are more precise).

Closes #155

Test plan

• coverage debug config parses the new .coveragerc correctly
• Unit suite passes the new --cov-fail-under=100 gate (237 passed, 3 xfailed; 100.0%)
• Full CI flow replicated locally: all three suites + coverage combine + coverage report --fail-under=100 (657 stmts, 0 missed, 170 branches, 0 partial)
• CI green across the Python 3.10–3.14 matrix

---

📚 Documentation preview 📚: https://ridgeplot--390.org.readthedocs.build/en/390/