Add coverage audit profiles with GFQL lock-ins - #1518

Closes #1517.

Follow-up: #1533 for repo-wide changed-line coverage hygiene.

Summary

• Add bin/coverage_audit.py, a profile-based coverage.py audit helper that emits markdown + JSON zero/low-hit reports.
• Add the first profile, gfql, for GFQL dead-code triage over parser, lowering, row-pipeline, temporal, AST, unified, and chain files.
• Add coverage and pytest-cov to the normal test extra so coverage infrastructure is managed with the rest of the test dependency stack.
• Collect pandas CPU coverage inside the existing test-gfql-core (3.12) job via pytest-cov + xdist instead of adding a duplicate standalone test run.
• Upload the gfql-coverage-audit-py3.12 artifact and append the markdown report to the GitHub step summary.
• Enforce strict per-file CPU coverage lock-ins in CI via graphistry/tests/compute/gfql/coverage_baselines/ci-pandas-py3.12.json; new resolved GFQL target files must be added to the baseline.
• Add checked-in periodic DGX RAPIDS 25.02 / 26.02 cuDF per-file lock-ins plus generic Docker wrapper env support.
• Keep operational usage notes in the script header instead of adding a standalone GFQL docs page.
• Add focused unit coverage for the audit helper and update the changelog.

Validation

• python3 -m py_compile bin/coverage_audit.py
• python3 -m json.tool graphistry/tests/compute/gfql/coverage_baselines/ci-pandas-py3.12.json
• python3 -m json.tool graphistry/tests/compute/gfql/coverage_baselines/rapids-25.02-cudf.json
• python3 -m json.tool graphistry/tests/compute/gfql/coverage_baselines/rapids-26.02-cudf.json
• bash -n docker/test-cpu-entrypoint.sh docker/test-rapids-official-local.sh
• python3 -m pytest -q graphistry/tests/test_coverage_audit.py -> 8 passed
• ./bin/ruff.sh bin/coverage_audit.py graphistry/tests/test_coverage_audit.py
• ./bin/typecheck.sh bin/coverage_audit.py graphistry/tests/test_coverage_audit.py
• git diff --check origin/master...HEAD
• Expanded local CPU audit: 2878 passed, 193 skipped, 15 xfailed; 42 target files; aggregate target coverage 11984/15136 = 79.18%; baseline passed.
• xdist/pytest-cov smoke: 391 passed, 17 skipped; audit consumed the generated .coverage file.
• DGX RAPIDS/cuDF on clean checkout with generic WITH_COVERAGE_AUDIT / COVERAGE_* envs:
  • RAPIDS 26.02: 411 passed, 5 warnings; aggregate target coverage 6209/15136 = 41.02%; baseline passed.
  • RAPIDS 25.02: 411 passed, 6 warnings; aggregate target coverage 6218/15136 = 41.08%; baseline passed. Known 25.02 warning: cuDriverGetVersion() takes no arguments; wrapper continued and tests passed.
• Review skill converged after the dependency/workflow integration update; no BLOCKER/IMPORTANT findings remain.

Coverage Stats

• CPU expanded GFQL/core audit: 42 files, aggregate target coverage 79.18%.
• RAPIDS 26.02 cuDF wrapper profile: 42 files, aggregate target coverage 41.02%.
• RAPIDS 25.02 cuDF wrapper profile: 42 files, aggregate target coverage 41.08%.
• This PR uses per-file lock-ins for the audited target surface, not an arbitrary repo-wide 80% gate. Repo-wide changed-line coverage hygiene is tracked separately in Add changed-line coverage hygiene gate for Python PRs #1533.

Notes

• Coverage output is triage evidence only, not deletion proof.
• GFQL is currently the only registered profile; this avoids baking GFQL into the runner API while keeping this PR scoped to GFQL cleanup: add CPU/GPU coverage audit for dead-code candidates #1517.
• DGX shared-box note: validation observed a VLLM process using about 81 GiB GPU memory; the selected wrapper profile stayed within available capacity.

Do not auto-merge.