ci: print exact uncovered locations when the coverage gate fails

The per-file 100% thresholds name only the failing file. A custom istanbul
reporter now prints one clickable path:line:col record per uncovered
statement, branch path, and function, right above the threshold errors, in
both the CI coverage lane and local test:coverage runs (they share this
config). CJS because istanbul-reports loads custom reporters with a bare
require() outside the tsx/ESM pipeline.

pnpm-lock.yaml

@@ -62,6 +62,9 @@ importers:
       fast-check:
         specifier: ^4.8.0
         version: 4.8.0
+      istanbul-lib-report:
+        specifier: ^3.0.1
+        version: 3.0.1
       js-yaml:
         specifier: ^4.2.0
         version: 4.2.0