Sync compiled-source coverage checker semantics from tenferro-rs

[shinaoka]

Problem

template-rs/scripts/check-coverage.py currently judges only the files present in coverage.json.
That is too weak for Rust workspaces with feature-gated modules and module-local unit tests.

The checker should instead judge only the runtime-bearing src/**/*.rs files that were actually compiled in the current cargo llvm-cov run.

Reference implementation

A proven downstream implementation already exists in local tenferro-rs work on branch coverage-85-no-exceptions.
Use these files as the source reference when porting the logic:

• tenferro-rs/scripts/check-coverage.py
• tenferro-rs/scripts/tests/test_check_coverage.py

Do not copy the downstream threshold policy wholesale. The important part here is the checker semantics.

Desired behavior

template-rs/scripts/check-coverage.py should:

1. Derive the expected source universe from target/llvm-cov-target/**/*.d dep-info when available.
2. Judge only src/**/*.rs files that were actually compiled in the current run.
3. Ignore module-local unit test sources such as src/<module>/tests/*.rs.
4. Ignore declaration-only Rust source files that contain no runtime-bearing code regions.
5. Fall back to a repository scan only when dep-info is unavailable.
6. Correctly resolve repo-relative dep-info paths.
7. Preserve threshold config support for default, files, and exclude.
8. Preserve --report-only behavior if the current checker surface already relies on it.

Regression tests to add

Port or recreate the script tests that prove these cases:

• fail when a compiled src/**/*.rs file is missing from coverage.json
• ignore src/<module>/tests/*.rs
• ignore feature-gated files not compiled in the current lane
• ignore declaration-only compiled source files with no runtime code
• resolve repo-relative dep-info entries

Why this matters

This is the right contract for local coverage checking in template-based Rust repos:

• local coverage should validate the canonical lane that was actually built
• exhaustive feature combinations belong in CI matrix jobs, not in the local checker
• module-local unit tests should not pollute the coverage source inventory

Out of scope

Do not bundle these into this change:

• raising the default threshold value
• repo-specific smoke-test additions used to clear downstream coverage gaps
• downstream PR workflow or CI policy changes