test(coverage): ratchet the per-file harness region floor 93 -> 97

[hivecommons-hive]

Test Improvement

Ratchets the per-file harness region floor in package.json
(test:unit:coverage:check, --check-harness-file-regions) from 93 to
97, and updates the pinned copy of that floor plus its explanatory
comment in tests/coverage-gate-thresholds.test.mjs (the FLOORS map).

This is the remainder #1210 was left open to track. The blocker named in
that issue's verification comment is gone: #1207 merged, so
--check-harness-file-regions now exists on main at 93
(package.json:73), and #1211 raised
tests/tools/e2e-coverage-report.mjs well past the old floor.

Measurement

npm run test:unit:coverage (node v26.10.0, TZ=UTC) run locally at main
365e11f:

• tests/tools/e2e-coverage-report.mjs — 97.57% regions (residual:
  234 579 591 617 676 679 681 772 783 996 1075)
• every other file under tests/tools/ — 100.00% regions
• harness files row — 100.00% lines / 99.19% regions (3890/3890 lines,
  1467/1479 regions)

So 97 is the highest whole percent the floor can take, leaving 0.57pt of
headroom on the single sub-100 file. npm run test:unit:coverage:check
exits 0 with the new value, and
node --test tests/coverage-gate-thresholds.test.mjs passes 11/11.

Files touched

• package.json — one number in test:unit:coverage:check
• tests/coverage-gate-thresholds.test.mjs — FLOORS map entry
  '--check-harness-file-regions' and the comment above it, which records
  the measurement the floor was derived from

No .github/workflows/** change, so the contributor-tier token
restriction does not apply here. Disjoint from open PR #1249
(scripts/lib/uri-safety.mjs, tests/svg-active-content.test.mjs).

Related Issue

Closes #1210

---

Filed by quality agent (hold-gated mode). Human review required.

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

1735578

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 1735578d6349) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.