test: pin sourceBoundaryOffsets short-segment guard and multi-boundary sort

[hivecommons-hive]

Test Improvement

Adds tests/e2e-coverage-source-boundary-segments.test.mjs, pinning two
branches of sourceBoundaryOffsets (tests/tools/e2e-coverage-report.mjs) that
had no unit coverage. That function finds the generated offsets where a bundle's
source map changes original source; convertScript cuts each V8 range there so
no sub-range straddles two modules, because v8-to-istanbul abandons a range
whose ends map to different sources (source.js, if (start.source !== end.source) return {}).

1 — if (segment.length < 4) continue; A source map may emit a 1-field
segment: a generated column mapped to no source. Webpack and terser output
contains them. segment[1] is then undefined, so without the guard the
segment reads as a change of source — it manufactures a boundary that is not a
module edge, and leaves previousSource at undefined so the next genuine
segment looks like a change too.

2 — [...boundaries].sort((a, b) => a - b) Never invoked: every existing
fixture (tests/e2e-coverage-source-boundary.test.mjs) produces at most one
boundary. splitRangeAtBoundaries walks the cut list assuming ascending order,
advancing start to each cut in turn, so the sort is load-bearing for any
bundle with three or more modules.

Both tests assert on the reported regions count, not on percentages: a
spurious cut splits one region into two without changing which lines ran, so
linePercent and regionPercent are identical either way and would not catch
a regression.

Mutation-tested

mutation	result
if (segment.length < 4) continue; → if (false) continue;	test 1 fails: Beta reports 2 regions, expected 1
.sort((a, b) => a - b) → .sort((a, b) => b - a)	test 2 fails: collectE2ECoverage throws No src/** coverage was attributable

Coverage

Measured locally with npm run test:unit:coverage (node v26.10.0, TZ=UTC):

	before	after
tests/tools/e2e-coverage-report.mjs regions	97.57%	97.98%
harness files regions	99.19%	99.32%

npm run test:unit:coverage:check passes with the thresholds package.json
currently sets, and the per-file harness figure clears both the current
--check-harness-file-regions 93 and the 97 that #1250 proposes.

Scope

Test-only: one new file under tests/. No production code, no workflow files,
no change to any existing test or threshold. Disjoint from the open PRs —
#1249 (scripts/lib/uri-safety.mjs, tests/svg-active-content.test.mjs) and
#1250 (package.json, tests/coverage-gate-thresholds.test.mjs) — and from
#1222 and #1232, which are both .github/workflows/**.

Related Issue

Closes #1251

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.