Publish HTML coverage reports on PRs

Upload the HTML coverage reports generated by `just test --coverage --html` to an ephemeral public URL on each PR, and surface the result as a commit status check. This lets reviewers browse actual coverage without downloading CI artifacts.

Candidate tool: [smokeshow](https://github.com/samuelcolvin/smokeshow) — free, no account needed, just a `SMOKESHOW_AUTH_KEY` secret.

Start by running `just test --coverage --html` to confirm the HTML report output, then inspect the pull-request CI configuration and how commit status checks and secrets are handled. Done means each PR publishes the generated report to an ephemeral public URL and exposes that result as a commit status check.

Written by the indexing model from the issue text.