fix: publish coverage independently of unrelated CI failures

[helly25]

Publish valid Rust coverage even when unrelated CI jobs fail, and put post-merge before pre-merge results within each PR.

AG;DR

• Adapt Fix coverage publication gating and pre/post-merge ordering xff#885. Route every completed CI workflow to the trusted coverage publisher; query the source attempt’s paginated jobs and ingest only when Rust coverage succeeded. Lifecycle and manual metadata refresh remain independent.
• Use the attempt-specific jobs endpoint to match coderef’s immutable coverage-RUN-ATTEMPT artifact naming and prevent a later retry from changing eligibility for an earlier event. Failed, cancelled, skipped, or missing coverage preserves existing reports; API errors fail publication.
• Explicitly order post-merge first within each PR while retaining merge-time group ordering. Preserve trusted main checkout and the shared serialized publication queue; release publication retains its existing success gate.
• Update executable shell tests for paginated jobs, source-attempt arguments, eligibility, and API failures; extend event routing and phase-order regression assertions.
• Based on main after fix: show pre-merge and post-merge coverage per PR #138 merged; no outstanding parent dependency. Parent main CI 35465782267 and coverage publication 35465870906 succeeded.
• Validation on pushed head 1db4b49: all 59 Python tests and applicable pre-commit hooks passed. CI 35466518751 passed every job including the final done gate. The phase-order regression fails against the prior implementation.
• Uses existing bash, gh, jq, and Python standard library; no new files or dependencies. Previously suppressed historical runs are not automatically replayed.