ci: set coverage threshold to 100%, govulncheck gated behind go-build

Coverage check now requires 100% (fail on any uncovered line).
govulncheck (vulns) now has needs: [go-build], placing it in the gate block alongside vet/lint/staticcheck/gosec.
Test and race already depended on vulns, so the chain is: go-build → gate jobs (incl vulns) → test+race.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -347,11 +347,11 @@ jobs:
           if [ -f coverage.out ]; then
             COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
             echo "Total coverage: $COVERAGE%"
-            if [ "$(echo "$COVERAGE < 50" | bc)" -eq 1 ]; then
-              echo "FAIL: Coverage $COVERAGE% is below 50% threshold"
+            if [ "$(echo "$COVERAGE < 100" | bc)" -eq 1 ]; then
+              echo "FAIL: Coverage $COVERAGE% is below 100% threshold"
               exit 1
             fi
-            echo "PASS: Coverage $COVERAGE% meets 50% threshold"
+            echo "PASS: Coverage $COVERAGE% meets 100% threshold"
           else
             echo "No coverage file generated (prod build)"
           fi
@@ -429,6 +429,7 @@ jobs:
 
   vulns:
     name: Go vulnerabilities
+    needs: [go-build]
     runs-on: ubuntu-latest
     defaults:
       run: