fix(ci): review follow-ups for the coverage lane split

- Split DSH_COVERAGE_MAX_WORKERS between the two parallel gates
  (instrumented gets ~2/3, exempt gets ~1/3, both at least 1) so the
  lane never exceeds the budget the failover pool's 8 x 6-instance
  bound assumes; a budget of 1 pairs with DSH_GATE_CONCURRENCY=1 on
  the serial reference lanes, which already prevents gate overlap.
- Fail loud on a set-but-not-'1' DSH_COVERAGE_EXEMPT_HEAVY value in
  vitest.config.ts instead of silently ignoring it.
- Add coverage-exempt.spec.ts: each roster entry's filter and exclude
  must select the same non-empty spec set and entries must not
  overlap, so a renamed suite breaks the gate instead of silently
  returning to the instrumented run with a stale roster.

vitest.config.ts

@@ -40,7 +40,12 @@ const testIncludes = [
 
 // The instrumented coverage gate sets this env; the exempt heavy suites then
 // run beside it uninstrumented (membership contract in scripts/coverage-exempt.ts).
-const coverageExemptExcludes = process.env[COVERAGE_EXEMPT_ENV] === '1'
+// A set-but-not-'1' value is a misconfiguration, not a silent no-op.
+const coverageExemptRaw = process.env[COVERAGE_EXEMPT_ENV]
+if (coverageExemptRaw !== undefined && coverageExemptRaw !== '' && coverageExemptRaw !== '1') {
+  throw new Error(`vitest config: ${COVERAGE_EXEMPT_ENV} must be '1' or unset, got ${JSON.stringify(coverageExemptRaw)}.`)
+}
+const coverageExemptExcludes = coverageExemptRaw === '1'
   ? coverageExemptHeavySuites.map(suite => suite.exclude)
   : []