fix: refresh coverage on PR merge, close, and reopen

[helly25]

Refresh the coverage overview when PRs merge, close, or reopen, without waiting for main CI. Adapts mboworks/xff#883 to coderef’s combined release/coverage Pages workflow.

AG;DR

• Add trusted pull_request_target closed/reopened events. A PR merge emits closed. Execute publisher code from main only; never check out PR head code in the privileged job.
• Add workflow_dispatch input coverage_refresh=true for metadata-only refreshes. Preserve default release dispatch and existing tag/config inputs. Explicit job conditions prevent lifecycle events from publishing a release.
• Restrict artifact download, source annotation, and archival to successful CI workflow completions. Lifecycle/manual refreshes query current PR state, rebuild overview/history, retain the site, and deploy without report input or CI identity.
• Keep every path in the existing serialized coverage-pages queue. Coverage refresh does not replace run identity, measurements, or detailed reports. Support refresh before any report has been archived.
• Validation: 57 Python tests and all applicable pre-commit checks pass locally. Tests cover trigger routing, trusted checkout, shared queue, merge-time reordering, closure/reopening visibility, unchanged archived bytes, local Git publication without an incoming report, and empty history. The routing regression fails against the old workflow. Actionlint passes with only the local older tool’s unsupported pre-existing queue key excluded. All required current-head PR CI checks passed on 745cabf (run 35462813061), including the 57 Python tests. The branch contains current main.
• Portability/dependencies: existing Python standard library, Bash, jq, Git, and rsync; no new dependencies or Bazel adoption. Builds on already-merged fix: show one coverage overview row per target #136; no outstanding PR dependency.
• Limitations: refresh waits for an active publication in the shared queue. It refreshes PR metadata, not latest main measurements. Live lifecycle dispatch and Pages deployment require post-merge verification.