fix: kcov not available on ubuntu-24.04 (ubuntu-latest) — coverage job breaks when bats tests exist

[don-petry]

Problem

The org-standard ci.yml template's coverage job installs kcov via sudo apt-get install -y -qq bats kcov. Since ubuntu-latest on GitHub Actions now resolves to Ubuntu 24.04, and kcov was dropped from Ubuntu 24.04's package repositories, the job fails with:

E: Unable to locate package kcov
Process completed with exit code 100.

This only manifests once a repo has .bats test files — the green-until-tests early-exit in the script no longer fires.

Affected repos

Any repo that:

1. Has tests/**/*.bats files
2. Uses runs-on: ubuntu-latest in the coverage job (i.e., every repo tracking the standard template)

petry-projects/repo-template is currently broken (PR #82 CI failing). Patched there with a temporary runs-on: ubuntu-22.04 workaround pending this upstream fix.

Suggested fix

Options (in order of preference):

1. Pin coverage job to ubuntu-22.04 (minimal change; 22.04 is supported until April 2027)
2. Download a pre-built kcov binary from GitHub Releases or build from source in CI
3. Install bats via npm (bats-core) and drop kcov instrumentation, running bats directly — the job remains a pass/fail gate without coverage percentages

The template in standards/workflows/ci.yml needs updating, and the fix should be synced fleet-wide via the standards-deploy workflow.

[don-petry]

Additional finding (2026-07-23): the ubuntu-22.04 pin workaround ALSO fails — kcov crashes silently

While converging repo-template's channel pins (repo-template#88), I found the coverage job is broken beyond the package-availability issue described above:

• repo-template's ci.yml already applies the runs-on: ubuntu-22.04 workaround, where kcov (v38) is in apt and installs cleanly.
• But the actual run then fails: kcov --include-path=. --exclude-path=tests,coverage coverage bats "${bats_files[@]}" runs for ~85s producing ZERO output, then exits 1 — a kcov instrumentation crash, not a package or test failure (no not ok lines ever print).
• PR repo-template#87's kcov-42-from-GitHub-releases approach also fails coverage the same silent way — so upgrading kcov version is not sufficient on its own.
• coverage is currently RED on repo-template main (all 3 recent CI runs) and on both open PRs (feat(workflows): centralize standards via reusable workflows #87, feat(workflows): pin reusable callers to @v1 and document tier model #88). It is non-required, but the pr-review agent gates on all checks, so it silently blocks auto-approval of every repo-template PR (incl. pin-only convergence feat(workflows): pin reusable callers to @v1 and document tier model #88, which had to be admin-merged).

Implication

The fix needs to make kcov actually instrument bats successfully (or switch coverage tooling / make the job resilient), not just resolve kcov's availability. Suggest reproducing locally with kcov 38 and 42 against repo-template's tests/**/*.bats to find the crash, and consider a fallback that keeps coverage green (e.g. bats-core's built-in coverage, or kcov --bash-method=... tuning, or making the job soft-fail with a warning until fixed).