Add changed-line coverage hygiene gate - #1535

Closes #1533.

Summary

• add bin/changed_line_coverage.py to report and gate coverage for changed executable package lines only
• reuse coverage collected in existing CI lanes: GFQL py3.12 coverage plus the py3.14 core-test leg, without adding coverage overhead to the 5-minute minimal sentinel
• add a PR-only combiner job that enforces an initial 80% changed-line threshold and uploads markdown/JSON reports

Validation

• python3 -m py_compile bin/changed_line_coverage.py bin/coverage_audit.py
• python3 -m pytest -q graphistry/tests/test_changed_line_coverage.py graphistry/tests/test_coverage_audit.py (13 passed)
• ./bin/ruff.sh bin/changed_line_coverage.py graphistry/tests/test_changed_line_coverage.py
• ./bin/typecheck.sh bin/changed_line_coverage.py
• parsed .github/workflows/ci.yml with PyYAML
• git diff --check

Notes

• CPU CI only; no DGX/RAPIDS validation needed because this changes CI hygiene and coverage reporting, not dataframe/GPU runtime behavior.
• Historical uncovered lines outside the PR diff remain non-blocking.
• The 5-minute test-minimal-python sentinel remains at 5 minutes and uninstrumented; changed-line coverage waits for later parallel/downstream coverage artifacts instead.