ci: print exact uncovered locations when the coverage gate fails

The per-file 100% thresholds name only the failing file. A custom istanbul
reporter now prints one clickable path:line:col record per uncovered
statement, branch path, and function, right above the threshold errors, in
both the CI coverage lane and local test:coverage runs (they share this
config). CJS because istanbul-reports loads custom reporters with a bare
require() outside the tsx/ESM pipeline.

THIRD_PARTY_NOTICES.md

@@ -130,6 +130,7 @@ External packages **directly declared** only by repository tooling, test infrast
 | [`eslint-plugin-sonarjs`](https://github.com/SonarSource/SonarJS) | LGPL-3.0-only |
 | [`execa`](https://github.com/sindresorhus/execa) | MIT |
 | [`fast-check`](https://github.com/dubzzz/fast-check) | MIT |
+| [`istanbul-lib-report`](https://github.com/istanbuljs/istanbuljs) | BSD-3-Clause |
 | [`jscpd`](https://github.com/kucherenko/jscpd) | MIT |
 | [`jsdom`](https://github.com/jsdom/jsdom) | MIT |
 | [`knip`](https://github.com/webpro-nl/knip) | ISC |