feat(site): site/ joins the coverage gate (#514)

[SUaDtL]

Closes #514. Implements DECISION-0032.

The gap

site/ was the one tested tree with no coverage command, so tdd Phase 5 and refactor Phase 2/6 reached it, found nothing to run, and took the no-tooling exemption — on a tree with 438 real tests.

That is the #507 failure mode by a different door: a gate that reads as satisfied without executing. #513 could only make it visible (via COVERAGE_EXEMPT), not close it.

The migration

vitest 3 → 4, matching the three plugin trees, with @vitest/coverage-v8 pinned to the same exact version. The two are peer-pinned, so a caret on one and not the other is precisely how they drift apart.

It needed no source changes — all 438 tests pass unmodified.

Baseline (AC-3)

Lines      91.29%  (619/678)
Branches   84.85%  (353/416)

Clears the stage-2 floor on both, so there is no shortfall to track and no #511-shaped campaign to open. Recorded in tech-stack.md's baseline table.

Scope of the measurement

include is scoped to scripts/ — the generator, link-audit and rehype helpers the suites actually exercise.

Deliberately not src/: those are Astro components rendered at build time and covered by the build plus the link audit. Counting them would report a large permanently-dark surface no test in this tree was ever meant to reach, and a number nobody can act on is worse than no number.

AC-4

COVERAGE_EXEMPT is now empty. Its comment says an entry must cite the decision that put it there rather than an issue number — an issue number reads as "someone will get to it" and outlives everyone who would. The companion stale-entry test is unchanged and still guards it.

Removing the exemption is what forced the rest: the doc-contract test went red until tech-stack.md actually named the command, which is the guard working as designed.

What does not transfer

site/ is the only tree with production dependencies (astro, starlight, markdown-remark) and is deliberately off the dev-inclusive CVE gate, whose sweep lives in docs.yml.

Adding a coverage provider does not change that posture — the provider is a dev dependency and the audit scope is untouched. Verified against the regenerated lockfile:

npm audit --omit=dev --audit-level=high  →  found 0 vulnerabilities

Per DECISION-0031 this tree carries no platform fork, so it stays single-host and needs no union.

Verification

Per the standing rule for site/ changes — not just the build:

npm test	438 passed
npm run build	131 pages
npm run typecheck	clean
link-audit	19026 internal links resolve
test_ci_impact.py	53 passed