ci(gitlab): add verify stage, use GitLab API, switch to pcov

[marcstraube]

Summary

• Add dedicated verify stage before test for GPG signature checks (fail fast)
• Use GitLab MR API instead of git merge-base for commit verification, pin alpine:3, use rules instead of deprecated only
• Switch from xdebug to pcov for code coverage (faster, lower memory)

Closes #1, closes #2, closes #3

Reference

• Aligned with zappzarapp/audit-logger .gitlab-ci.yml