Add two CI gates to enforce CONTRIBUTING.md test requirements:
1. File-matching check (lint job): fails PRs that change source files
without including test file changes. Exempts docs/chore/ci branches.
2. Coverage gate (build job): wires existing `npm run test:coverage`
into CI with c8 thresholds (40% statements/lines, 20% branches/functions).
Previously defined in package.json but never ran in CI.
Lowers coverage thresholds from 50% to 40% for statements/lines to match
current codebase reality (~44%) — prevents the gate from blocking every PR
on day one while still catching coverage regressions.
