fix(ci): capture review-enrichment's node:test coverage for Codecov

[nghetienhiep]

What

review-enrichment (@loopover/rees) is a standalone, non-workspace package with its own
node:test suite that runs in CI (npm run rees:test), yet none of its 83 src/** files were
visible to Codecov. The root vitest.config.ts listed exactly one file from it
(review-enrichment/src/analyzers/codeowners.ts) — and nothing vitest runs even imports that file,
so it was reported at 0% too. Net effect: a real regression anywhere in this package (including its
secret-scan.ts analyzer) could ship without the patch-coverage gate ever seeing it.

This wires the package's genuine coverage into Codecov as a separate rees flag, without pulling
review-enrichment into the root npm workspace or the vitest runner.

How

• rees:coverage script (root package.json) — re-runs the existing node --test suite under
  c8. The tests execute the built dist/**/*.js, so c8 remaps V8 coverage back to
  review-enrichment/src/** through the build's source maps (already emitted, sourceMap +
  inlineSources). Run from the repo root so lcov paths are review-enrichment/src/... — exactly
  what Codecov needs, no path rewriting. c8's default exclude drops *-test.*/*.test.* names,
  which wrongly caught the real flaky-test.ts analyzer, so the exclude is narrowed to **/*.d.ts
  (test files live in test/**, never in the dist/** include, so none leak in). Result: all 83
  src files reported, 0 dist/test leaks.
• .github/workflows/ci.yml — a REES coverage step (after the existing, authoritative
  uninstrumented REES ... tests step) harvests the lcov, a verify step fails CI if it is missing,
  and two upload steps (trusted + fork-tokenless, mirroring the shard uploads) send it under the
  rees flag. c8 instrumentation inflates the suite's timing-sensitive linear-time/ReDoS-guard
  assertions, so the harvest tolerates the child exit — pass/fail is already gated by the
  uninstrumented step, and a broken suite would show as ~0% patch regardless.
• validate-tests now also runs on rees-only changes — Codecov holds codecov/patch until
  after_n_builds (6) coverage uploads land; a rees-only PR doesn't otherwise touch backend, so
  without the shards it would upload a single report and the status would never post (the same
  vacuous check being fixed). The shards guarantee the 6-upload floor; the fast rees upload from
  validate-code is already merged in before the 6th shard trips the threshold.
• codecov.yml — registers the rees flag (scoped to review-enrichment/, carryforward) and
  documents why after_n_builds stays 6.
• vitest.config.ts — drops the stale, unexercised single-file coverage.include entry.

Verification

• npm run rees:coverage → 83 src files reported (was 0 tracked), paths review-enrichment/src/...,
  no dist/test leaks, ~91.8% lines / 86.5% branches.
• Uncovered branches are recorded as real DA:line,0 misses in the lcov, so an untested branch in a
  review-enrichment/src/** change now produces a genuine codecov/patch shortfall instead of the
  previous no-op.
• npm --prefix review-enrichment test (authoritative correctness gate) → 1335 pass, 0 fail.
• npm run actionlint, npm run typecheck, test/unit/codecov-policy.test.ts (+ the other
  CI-policy unit tests), npm ci --prefix review-enrichment, and npm audit --audit-level=moderate
  (0 vulnerabilities) all green; git diff --check clean.

Closes #6250

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.60%. Comparing base (189db3c) to head (e0bba24).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6431      +/-   ##
==========================================
- Coverage   95.61%   93.60%   -2.01%     
==========================================
  Files         598      671      +73     
  Lines       47310    67477   +20167     
  Branches    15056    18535    +3479     
==========================================
+ Hits        45235    63162   +17927     
- Misses       1291     3354    +2063     
- Partials      784      961     +177     

Flag	Coverage Δ
rees	88.51% <ø> (?)
shard-1	44.36% <ø> (+0.26%)	⬆️
shard-2	36.73% <ø> (+0.24%)	⬆️
shard-3	32.45% <ø> (+0.18%)	⬆️
shard-4	35.39% <ø> (+0.18%)	⬆️
shard-5	31.09% <ø> (+0.31%)	⬆️
shard-6	45.54% <ø> (+0.27%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 85 files with indirect coverage changes

[JSONbored]

Causing way too much CI churn, please stop force pushing.