test: enforce domain coverage floors

[FreeOnePlus]

Summary

• enforce a 55% whole-repository coverage floor
• enforce 80% aggregate coverage for protocol, authentication, and core manager domains
• add focused authentication and manager routing boundary tests
• wire the domain gate into GitHub Actions and document the release command

Validation

• Ruff, Mypy, Bandit, and lock-file checks passed
• 1079 tests passed, 68 skipped; total coverage 57.90%
• domain coverage: protocol 89.94%, authentication 81.18%, core managers 81.84%
• clean sdist/wheel build and fresh Python 3.12 wheel smoke passed
• official MCP 2026-07-28 conformance: 25/25 passed
• real Doris Streamable HTTP and true subprocess Stdio: 11/11 passed; cleanup residuals 0