ci: enforce Rust contract coverage

[Mojisola001-tech]

Overview

Adds measured Rust contract coverage to Meridian's existing contracts CI job.

Related Issue

Closes #533

Changes

Contract coverage gate

• [ADD] Install cargo-llvm-cov and llvm-tools-preview in the contracts workflow.
• [ADD] Run coverage for meridian-vault, meridian-blend-adapter, and meridian-defindex-adapter.
• [ADD] Enforce the measured 97.5% line-coverage floor and print the summary directly in CI logs.

Verification Results

cargo test --workspace
PASS (69 tests)

cargo fmt --all -- --check
PASS

cargo clippy --all-targets -- -D warnings
PASS

cargo llvm-cov --package meridian-vault --package meridian-blend-adapter --package meridian-defindex-adapter --summary-only --fail-under-lines 97.5
PASS (97.66% line coverage)

cargo build --target wasm32-unknown-unknown --release
Not completed locally because the Windows workspace ran out of disk space while downloading the wasm target.

Acceptance Criteria	Status
Coverage tooling runs for vault, blend-adapter, and defindex-adapter	Done
Initial threshold is set and enforced	Done — 97.5% line coverage
Coverage report is visible in CI output	Done — summary-only output

[vercel]

@Mojisola001-tech is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Mojisola001-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[collinsezedike]

adapter-common is missing from this --package list, so its coverage is never measured, confirmed directly in this run's own output: the printed table only has rows for blend-adapter/src/lib.rs, defindex-adapter/src/lib.rs, and vault/src/lib.rs, no adapter-common row at all. That crate has zero tests of its own (no #[cfg(test)] module) and still has two .unwrap()-based panics in require_vault_auth/get_usdc. #533's own motivation was closing exactly this kind of untested-panic gap in the code that custodies funds, so leaving out the one crate that's actually fully untested undercuts the point of adding the gate. Add --package adapter-common to the list.