test: raise statement coverage above 80% and add CI coverage gate

[joshua-temple]

Problem

cascade computes test coverage in CI but only echoes it to the log: there is no enforced threshold and no public signal. Overall statement coverage sits at 77.4%, below the 80% needed for the OpenSSF Best Practices test_statement_coverage80 (Silver) criterion.

Stacked on #395.

Fix

• Raise overall statement coverage from 77.4% to 82.6% with targeted tests for the lowest-covered core packages (promote, hotfix, reset, orchestrate, rollback, release, changelog, version).
• Add a coverage threshold gate to pr.yaml and validate.yaml: after the existing coverage computation, fail the job if total statement coverage drops below 80%.
• Add a coverage badge to README.

The gate is self-contained (an awk comparison on go tool cover -func output); no external coverage service or secret is required.

Verification

• go build ./... passes.
• go test -race ./... passes on all touched packages.
• golangci-lint run ./... clean; actionlint clean on both workflows.
• Total statement coverage measured at 82.6% (>= 80% gate, with margin).

Notes

• The README badge is static (82.6%); the CI gate is the live enforcement.
• Coverage is reported against the main module; the Docker-based e2e module is unchanged.