ci: make hot-path coverage gates required PR checks (#921)

* ci: make hot-path coverage gates required PR checks

Remove continue-on-error from frontend and Rust coverage jobs now that
the hot-path lists have stabilized; update docs and script headers.

* docs: note hard coverage gates in changelog and credits (PR #921)

* chore: drop credits entry for CI-only PR #921

Contributor credits are for user-visible work, not infra toggles.

.github/workflows/frontend-tests.yml

@@ -61,12 +61,7 @@ jobs:
 
   coverage:
     name: vitest --coverage (baseline + hot-path file gate)
-    # Two-layer gate: the script exits 1 when any listed file drops below the
-    # threshold (warning annotations show in the PR checks panel), but
-    # `continue-on-error: true` keeps it from BLOCKING merges. Drop the flag
-    # to flip the gate hard once we've watched a few PRs run cleanly.
     runs-on: ubuntu-24.04
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v6
@@ -78,7 +73,7 @@ jobs:
       - run: npm ci
       - name: vitest run --coverage
         run: npx vitest run --coverage
-      - name: hot-path file coverage soft gate
+      - name: hot-path file coverage gate
         run: bash scripts/check-frontend-hot-path-coverage.sh
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/rust-tests.yml

@@ -59,13 +59,7 @@ jobs:
 
   coverage:
     name: cargo llvm-cov (baseline + hot-path file gate)
-    # Layered: the gate script exits 1 when any hot-path file drops below
-    # threshold (see scripts/check-hot-path-coverage.sh) — the failure is
-    # visible in the PR's checks panel. `continue-on-error: true` keeps it
-    # from BLOCKING merges. Drop continue-on-error to flip the gate to a
-    # PR-blocker once we've watched a few PRs run cleanly.
     runs-on: ubuntu-24.04
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v5
       - name: install Linux build dependencies
@@ -89,7 +83,7 @@ jobs:
           mkdir -p target/llvm-cov
           cargo llvm-cov --workspace --lcov --output-path lcov.info
           cargo llvm-cov --workspace --json --output-path target/llvm-cov/cov.json
-      - name: hot-path function coverage soft gate
+      - name: hot-path file coverage gate
         run: bash scripts/check-hot-path-coverage.sh
       - uses: actions/upload-artifact@v4
         with: