Enforce CLI coverage in CI

[xianzuyang9-blip]

Summary

• add an explicit CLI coverage script and declare the matching Vitest v8 coverage provider
• run coverage on the Node 22 CI leg before uploading Codecov output
• use the same coverage gate in the release workflow so configured thresholds are actually enforced

Fixes #314.

Verification

• node config check confirmed package.json, workflows, and lockfile reference the coverage script/provider
• corepack pnpm -C packages/cli exec vitest run tests/utils/validators.test.ts --coverage loaded the v8 provider and generated packages/cli/coverage/coverage-final.json; the focused run failed thresholds as expected, confirming thresholds now execute

Note: a full local pnpm --filter anatomia-cli coverage run exceeded the 3 minute local timeout before producing final coverage output, so I did not use it as passing evidence.

[vercel]

@xianzuyang9-blip is attempting to deploy a commit to the Ryan's projects Team on Vercel.

A member of the Team first needs to authorize it.