ci(canvas): wire vitest --coverage into CI for baseline observability (#1815)

Step 2 of #1815. Step 1 (instrumentation in canvas/vitest.config.ts)
already shipped — the inline comment there explicitly defers wiring
into CI to a follow-up because turning on a 70% threshold blind would
either fail CI immediately or paper over a real gap with an ad-hoc
exclude list.

This PR ships the observability half:
- Replaces `npx vitest run` with `npx vitest run --coverage` in the
  canvas-build job. Coverage gets reported on every PR; no threshold
  gate yet (vitest.config.ts intentionally doesn't set thresholds).
- Adds an artifact upload step for canvas/coverage/ (HTML + json-summary)
  so reviewers can browse the coverage report from any PR. 7-day
  retention; if-no-files-found=warn so a step skip doesn't fail.

Step 3 (thresholds + hard gate) is the natural follow-up — track in a
new sub-issue once we've seen ~5-10 PRs of baseline data and know
where current coverage sits. The issue body proposed lines:70 /
functions:70 / branches:65 / statements:70; that may need adjustment
once the baseline lands.

Closes the Step-2 portion of #1815. Step 3 stays open or gets a fresh
issue depending on your preference.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -193,8 +193,24 @@ jobs:
           node-version: '22'
       - run: rm -f package-lock.json && npm install
       - run: npm run build
-      - name: Run tests
-        run: npx vitest run
+      - name: Run tests with coverage
+        # Coverage instrumentation is configured in canvas/vitest.config.ts
+        # (provider: v8, reporters: text + html + json-summary). Step 2 of
+        # #1815 — wires coverage into CI so we get a baseline visible on
+        # every PR. No threshold gate yet; thresholds dial in (Step 3, also
+        # tracked in #1815) after the team sees what current coverage is.
+        # Per the inline comment in vitest.config.ts: "first land
+        # observability so we can see the baseline, then dial in
+        # thresholds + a hard gate" — this PR ships the observability half.
+        run: npx vitest run --coverage
+      - name: Upload coverage summary as artifact
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: canvas-coverage-${{ github.run_id }}
+          path: canvas/coverage/
+          retention-days: 7
+          if-no-files-found: warn
 
   # MCP Server + SDK removed from CI — now in standalone repos:
   # - github.com/Molecule-AI/molecule-mcp-server (npm CI)