Coverage gate passes when its include globs stop matching: guard the measured file set #2709

Problem

The per-file ≥90 coverage gate only checks the files that end up in the coverage report. Nothing checks that the report covers the files it should, so if the include globs stop matching, coverage gating silently shrinks and local:gate (and CI) stay green.

This actually happened during the #2557 dependency refresh (analysis). Under vitest 5, which fixed "coverage include/exclude globs too eager", clients/web's include patterns (src/components/**/*.{ts,tsx}, the absolute core/… paths) stopped matching. Only clients/web/server/** still matched:

Every test passed, every remaining file cleared 90, and the gate went green. It was caught only because someone compared the summary file counts by hand. The vitest 5 bump was deferred for this reason, and this guard should land before it is attempted again.

This is the same failure class as #1301 (core/ files silently dropping out of the per-file gate), arrived at from a tooling upgrade rather than a path change.

Expected

A coverage run whose measured file set has collapsed or shrunk unexpectedly fails, naming the client and the files that went missing.

Suggested shape (implementer's call)

• Preferred: compare against an independent expansion. For each client, expand that client's own coverage include/exclude against the file system, using a glob library rather than vitest, and assert every expanded file appears in coverage-summary.json. That checks the scope against its own declaration with no number to maintain, and it would have reported ~400 missing web files by name. Any intended differences, such as files vitest legitimately omits, would need to be stated explicitly in the guard.
• Fallback: a floor. Record a per-client minimum file count and fail when a run falls below it. Simpler, but it needs bumping as files are added and only catches large drops.
• Wire it into the coverage step of local:gate and the CI coverage job, since it reads the coverage output (verify:* naming, alongside verify:format-coverage / verify:typecheck-coverage).
• Cover all five gated clients (web, cli, tui, launcher, mcpdo). Counts on v2/main as of chore(deps): monthly dependency refresh #2557: web 419, cli 20, tui 41, mcpdo 31, launcher 1.

Acceptance

• Re-applying the vitest 5 bump from chore(deps): monthly dependency refresh #2557 without fixing the globs makes the gate fail.
• v2/main as-is passes.