Require 80% coverage on the lines a pull request changes, with diff-cover #4199

What

Fail a pull request whose changed lines in policyengine_api/ are less than 80% covered by the unit and integration tests together:

• A new pr.yml job downloads the six test shards' coverage.xml files and the cross-database integration tests' report.
• It runs diff-cover --fail-under=80 against the pull request's base commit.
• CI complete needs the job, so a failure blocks the merge. No ruleset change is needed.
• diff-cover goes in the dev extra, locked in uv.lock.
• The rule api.quality.diff-coverage is registered, with a proof that runs diff-cover just at and just below the minimum.

Why

Nothing requires a pull request's changes to come with tests. Codecov's patch status reports the coverage of the changed lines, but only as an informational status. Over the last 40 merged pull requests, 13 changed measured code. Their changed lines were 75.0% to 100% covered, and one (#4179, 75%) would have failed at 80%.

diff-cover runs inside CI, so it doesn't depend on Codecov being up. It combines several reports (a line is uncovered only if every report misses it), and its failure lists the uncovered lines. This is step 2.7's diff-coverage check, with the 80% minimum decided in tracker task 6.4 · 6.