Integrate JaCoCo coverage into CodeQL analysis with 90% instruction coverage gate

[Copilot]

Wires JaCoCo XML coverage reports into the CodeQL workflow and enforces a 90% instruction coverage minimum that fails CI — blocking merges — when the threshold isn't met.

build.gradle.kts

• Adds a root-level JacocoCoverageVerification task (testCodeCoverageVerification) enforcing ≥ 90% instruction coverage across all submodules against the aggregated jacoco-report-aggregation report
• Hooks the verification into tasks.check so both the gradle-build and CodeQL workflows enforce it on every run

val coverageVerification = tasks.register<JacocoCoverageVerification>("testCodeCoverageVerification") {
    dependsOn(tasks.named<JacocoReport>("testCodeCoverageReport"))
    violationRules {
        rule {
            limit {
                counter = "INSTRUCTION"
                minimum = "0.90".toBigDecimal()
            }
        }
    }
    ...
}

tasks.check {
    dependsOn(tasks.named<JacocoReport>("testCodeCoverageReport"))
    dependsOn(coverageVerification)
}

.github/workflows/codeql.yml

• Switches build-mode from autobuild → manual; the manual build step runs ./gradlew check which produces the aggregated JaCoCo XML report
• Passes the report to codeql-action/analyze via coverage-report so CodeQL embeds coverage percentage in its SARIF output
• Sets upload: always so coverage is reported on every run, not just failures