ci: no coverage gate, floating action tags, no lockfile

[tcconnally]

From the 2026-08-11 test-suite + CI audit.

• No coverage measurement or --fail-under gate (strict markers only).
• All workflows use floating action tags (@v4/@v5/@v6/@release/v1)
  — pin to SHAs.
• No lockfile/constraints — CI resolves unpinned latest deps.

Recommendation: add coverage with a fail-under gate once a baseline is
known, pin actions, and commit a constraints/lockfile (or pin minimum
versions in pyproject).

[tcconnally]

Resolved by PR #233 (merged to main as 8dc8d14). Engine leg gates coverage with --cov-fail-under=65 (baseline 70.7%, 2026-08-12). All actions pinned to immutable commit SHAs (checkout v4.2.2, setup-python v5, docker login/metadata/build-push, pypi-publish release/v1). New constraints.txt pins direct deps to exact versions within pyproject bounds (stripe<14, reportlab<5, pytest<10); every workflow installs with -c constraints.txt. concurrency cancel-in-progress added. Verified: 711 passed / 70.69% coverage locally, full matrix green on PR #233.