test: add 24 critical-path test files across control plane, SDKs

.github/BRANCH_PROTECTION.md

@@ -110,6 +110,7 @@ In rare cases (critical hotfixes, CI infrastructure issues), an admin may approv
 2. Fix failures promptly
 3. Don't push new commits while CI is running (wait for results)
 4. Keep your branch up to date if `main` changes
+5. Review the coverage summary artifact when changes materially affect test-sensitive surfaces
 
 ### When CI Fails
 1. Read the error message carefully
@@ -118,6 +119,14 @@ In rare cases (critical hotfixes, CI infrastructure issues), an admin may approv
 4. Test locally before pushing
 5. Push the fix and wait for CI to re-run
 
+### Coverage Summary
+
+The repository also publishes a non-blocking coverage summary workflow:
+
+- It uploads per-surface coverage artifacts rather than a single blended monorepo number.
+- It is intended to support reporting and badge generation, not to replace functional tests.
+- The local equivalent is `./scripts/coverage-summary.sh`.
+
 ## Understanding the "All Required Checks Passed" Job
 
 Each workflow has a summary job called "All Required Checks Passed" that:

.gitignore

@@ -62,3 +62,4 @@ reports/
 
 # Typescript
 .env
+.plandb.db