ci: enforce Rust contract coverage

[Mojisola001-tech]

Overview

Adds measured Rust contract coverage to Meridian's existing contracts CI job.

Related Issue

Closes #533

Changes

Contract coverage gate

• [ADD] Install cargo-llvm-cov and llvm-tools-preview in the contracts workflow.
• [ADD] Run coverage for meridian-vault, meridian-blend-adapter, and meridian-defindex-adapter.
• [ADD] Enforce the measured 97.5% line-coverage floor and print the summary directly in CI logs.

Verification Results

cargo test --workspace
PASS (69 tests)

cargo fmt --all -- --check
PASS

cargo clippy --all-targets -- -D warnings
PASS

cargo llvm-cov --package meridian-vault --package meridian-blend-adapter --package meridian-defindex-adapter --summary-only --fail-under-lines 97.5
PASS (97.66% line coverage)

cargo build --target wasm32-unknown-unknown --release
Not completed locally because the Windows workspace ran out of disk space while downloading the wasm target.

Acceptance Criteria	Status
Coverage tooling runs for vault, blend-adapter, and defindex-adapter	Done
Initial threshold is set and enforced	Done — 97.5% line coverage
Coverage report is visible in CI output	Done — summary-only output

[vercel]

@Mojisola001-tech is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Mojisola001-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[collinsezedike]

adapter-common is missing from this --package list, so its coverage is never measured, confirmed directly in this run's own output: the printed table only has rows for blend-adapter/src/lib.rs, defindex-adapter/src/lib.rs, and vault/src/lib.rs, no adapter-common row at all. That crate has zero tests of its own (no #[cfg(test)] module) and still has two .unwrap()-based panics in require_vault_auth/get_usdc. #533's own motivation was closing exactly this kind of untested-panic gap in the code that custodies funds, so leaving out the one crate that's actually fully untested undercuts the point of adding the gate. Add --package adapter-common to the list.

[collinsezedike]

The --package list omits adapter-common, a workspace member (see packages/contracts/Cargo.toml) whose code is exercised by the other packages' tests but never measured or gated by this 97.5% threshold. Untested branches added to adapter-common can ship at 0% coverage while this gate still passes.

[collinsezedike]

This step and the new cargo llvm-cov step below both compile and run the full contract test suite, so every CI run now builds and tests the workspace twice, once uninstrumented here and once instrumented for coverage, for no extra signal since cargo llvm-cov already fails on a test failure too. Worth dropping this step in favor of the coverage one, or vice versa.