feat(cli): add --min-coverage threshold

[rodboev]

Summary

Added --min-coverage FLOAT as an opt-in CLI gate over the existing canonical coverage percentage. A below-threshold scan exits 1 after writing its normal report.

Changes

• Validate finite thresholds in the CLI's existing option framework.
• Use strict less-than semantics, so equality passes.
• Apply the same policy to single scans, each recursive child, and the recursive aggregate scope.
• Fail closed when enabled coverage is missing or non-numeric, while preserving execution and existing gate precedence.

Preserved

Default behavior, --fail-on-incomplete, risk scoring and recommendation, output schemas, ledger coverage computation, and registry-mode boundaries remain unchanged.

Validation

Focused CLI tests cover threshold boundaries, recursive children and aggregate scope, invalid values, output-before-exit, missing coverage, precedence, and schema preservation. Verification completed: 112 passed, ruff check passed, ruff format --check passed, and git diff --check passed.

Related

Closes #389. PR #393 supplies the separate --fail-on-incomplete behavior.

[rng1995]

[SkillSpector Review]\n\nApproved. The coverage threshold validates finite values in range, fails closed on absent or non-numeric coverage, uses strict less-than semantics, and composes correctly with recursive and existing exit-code behavior. Current required checks pass.

[mohgupta-ship-it]

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

• Rating: new feature
• Confidence: high
• Status read: Approved, branch behind, green checks
• Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
• Council assessment: Targeted CLI min-coverage threshold feature with tests for thresholds, absent/non-numeric coverage, recursive behavior, and invalid values.
• Recommended action: Update branch, rerun CI, then merge if still green.