chore(ci): restore unit-test coverage threshold to 70% #67

Context

As part of unblocking #57, PR #66 lowered the CI-enforced unit-test coverage threshold from 70% → 60% (in .github/workflows/ci.yml + Makefile) because:

• main has been hovering at ~62% for months; the 70% bar was aspirational and was blocking the Test check.
• make coverage (via gotestsum) includes packages with no _test.go files (internal/dedupe, internal/mq, internal/observability, internal/testutil) which pull the measured total down to 54.7% even though the packages that have tests sit around 64.9% — hence the need to configure .testcoverage.yml with exclude.paths for the untested packages so the threshold reflects reality.

AGENTS.md documents 70% as the minimum; this issue tracks getting back there.

Work to get back to 70%

Weakest packages (from go tool cover -func):

• internal/api (~59%) — stream_sse.go, stream_ws.go, structured_query.go Handle() paths are large and uncovered. A fake jetstream.JetStream + in-memory hub would unlock these.
• internal/pipes (~61%) — Store.refresh + loadFromDirectory require a real NATS KV to test; add tests using the embedded NATS test harness.
• internal/discovery (~71%) — Refresh needs a ClickHouse-driver fake to exercise the system.columns query and type-mapping branches.
• internal/policy (~59%) — Store.Watch KV-watch loop and error branches uncovered.
• internal/dedupe, internal/mq, internal/observability — currently excluded from the measured total via .testcoverage.yml. Add basic tests for the Embedded / Distributed dedup constructors, the NATS publish / subscribe paths, and the observability provider wiring, then drop the exclusions.

Acceptance

• Total unit-test coverage (with .testcoverage.yml exclusions removed) ≥ 70% — the bar AGENTS.md actually states.
• Revert the temporary threshold drop in .github/workflows/ci.yml and Makefile (threshold-total: 70, COVERAGE_THRESHOLD := 70).
• Delete .testcoverage.yml (or at least the exclude.paths section for packages that now have tests).
• CHANGELOG entry under [Unreleased] → ### Changed documenting the revert.

References

• ci: fix main's broken CI and restore full ruleset gating #57 — the parent issue whose PR (fix(ci): sweep errcheck, resolve hub and ingest test failures #66) introduced the interim 60% threshold
• fix(ci): sweep errcheck, resolve hub and ingest test failures #66 — the PR that added the temporary exclusions and .testcoverage.yml
• AGENTS.md — project coverage policy (70% min, 80% aspirational)