fix(sovereign-ci): bin-only crates could never pass test or coverage

[noahgift]

The defect

Every branch of the test and coverage fallback chains passes --lib:

TEST_SCOPE: ${{ inputs.test_workspace && '--workspace --lib' || '--lib' }}

And cargo test --lib does not merely fail on a crate without a [lib] target — it errors:

error: no library targets found in package `cohete`   (exit 101)

So a bin-only repo had no reachable configuration. test_workspace only toggles --workspace; both of its values keep --lib.

Where it showed up

cohete's ci / coverage job, red for this and nothing else:

error: process didn't exit successfully: `cargo test ... --lib` (exit status: 101)
error: process didn't exit successfully: `cargo test ... --lib -p cohete` (exit status: 101)
::error::Coverage failed — check workspace path dependencies

Its CI last passed 2026-04-03, before this chain took its current shape.

The same --lib assumption independently made cohete's local pre-push hook unpassable — so every push there used --no-verify, and 84 rustfmt diffs plus 2 clippy errors accumulated behind the bypass (paiml/cohete#4). A gate that cannot pass is worse than no gate: it trains everyone to bypass it, and then real findings ride in behind the bypass.

The fix

One more link on each chain, without --lib. Covers bins, integration tests and doctests; works with or without a [lib].

Purely additive. A crate that has a lib target satisfies an earlier branch and never reaches the new line, so behaviour is unchanged for every repo that works today.

I verified the || \-with-comment chains still short-circuit correctly in both directions — fallback skipped when the prior command succeeds, run when it fails — rather than assuming either way.

⚠️ Review please — blast radius

This workflow is called by roughly 30 fleet repos. I am not self-merging it.

Refs PMAT-203.

🤖 Generated with Claude Code

[noahgift]

Heads-up from paiml/infra's nightly shared-cargo-home-guard — this branch is
flagged BLOCK, and it is a staleness artefact rather than something this PR did:

cargo-install-boot-volatile BLOCK .github#44/sovereign-ci.yml
  job=security step=Install_cargo-audit_(per-runner_CARGO_HOME)
  :: install root is emptied at boot: /tmp/cargo-home-security-RUNNER

This branch: CARGO_HOME="/tmp/cargo-home-security-${{ runner.name }}"
main: CARGO_HOME="$RUNNER_TOOL_CACHE/cargo-home-security"

/tmp is emptied at boot, so cargo-audit reinstalls on every fleet reboot;
$RUNNER_TOOL_CACHE persists. main already carries the better form — this
branch is 20 commits behind and predates that change.

No action needed beyond merging/rebasing main before this lands. Flagging it
because the guard scans open PR heads, not just default branches (a PR
migrating jobs onto the fleet is precisely how the fleet has been broken
before), so it will keep reporting until the branch catches up — and because if
this merged as-is it would reintroduce the regression on main.

Not pushing to your branch. Found while getting infra's nightly audit green
after 43 days red (paiml/infra#489).