docs(coverage): sync docs to shipped state + wire sandcastle prompts

Closes the staleness gap after the 10-commit coverage epic shipped.

Doc sync (item 1 from the user's choice):
  - CLAUDE.md Quick Start: adds pnpm coverage:aggregate / coverage:diff
    / mutate to the command listing
  - CLAUDE.md: new "Sibling architecture: coverage (ADR-020)" section
    after the conformance gate table — captures the 4-layer table +
    points at docs/guides/coverage.md + ADR-020 + says agents must run
    coverage:diff before reporting complete
  - AGENTS.md preamble: now lists coverage as a parallel multi-latency
    quality system alongside conformance, with the same gate / latency
    framing
  - PRD frontmatter: status draft -> shipped + shipped date +
    shipping-commits list (all 10 SHAs anchoring the trace)
  - PRD findings table: each row gets a Resolution column citing the
    commit that closed it; conclusion text updated to past tense
  - ADR-020 implementation phasing: rewritten as a status table with
    each step linked to the commit that shipped it + Boot-time
    assertFeatureConformance explicitly marked Deferred with rationale
  - docs/guides/coverage.md: removed "Boot wiring lands in the next
    story" line; replaced with the deferral rationale + clarified
    that two readers (vitest, coverage:diff) consume the manifest

Sandcastle prompts (item 2 from the user's choice):
  - .sandcastle/implementer.prompt.md: new "Coverage gates" section
    after the conformance-gates list, requiring `pnpm test --coverage`,
    `pnpm coverage:aggregate`, and `pnpm coverage:diff` to all pass
    before reporting `complete`. Machine-readable JSON shape of
    coverage:diff documented (status / uncovered[] / kind enum), with
    explicit instructions on how to interpret each kind. Allowlist
    expansion requires justification + test.
  - .sandcastle/reviewer.prompt.md: AC coverage relabeled to "AC
    coverage (acceptance criteria, not test coverage)" to disambiguate;
    new check #7 "Coverage gates (ADR-020)" requiring CI's
    Coverage — diff (L1) step green + per-layer thresholds met +
    no silent allowlist expansion + manifest band drift detection.

Effect: future agent runs through sandcastle now treat coverage as a
first-class blocking gate, parallel to conformance. PRs no longer
discover coverage failures only via CI; the implementer is required
to check before reporting done, and the reviewer is required to
verify.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.sandcastle/implementer.prompt.md

@@ -39,13 +39,34 @@ The generator handles step 1 + 2 for you when scaffolding a new feature.
 ```
 pnpm typecheck   # TS brand-slot enforcement, 0s
 pnpm lint        # ESLint rules incl. conformance/* — <1s
-pnpm test --filter @repo/<feature>   # tests for the feature you touched
+pnpm test --filter @repo/<feature> -- --coverage   # tests + per-layer thresholds for the feature you touched
 pnpm conformance # cross-feature event closure
 pnpm fallow:audit # whole-codebase analysis: dead exports, dupes, circular deps, complexity
 ```
 
 All five pass before you commit. If any fail, fix or report BLOCKED — do not paper over.
 
+## Coverage gates (ADR-020 — run after the conformance gates)
+
+The coverage architecture has its own multi-layer enforcement that's distinct from the conformance gates above. Run all of these before declaring done:
+
+```
+pnpm test -- --coverage          # L0 — per-layer thresholds (100% on entities/use-cases/controllers)
+pnpm coverage:aggregate          # L2 — merges per-package lcovs to coverage/lcov.info + coverage/summary.json
+pnpm coverage:diff -- --base <base-ref>   # L1 — cover-the-diff: every changed line must be exercised
+```
+
+Treat `pnpm coverage:diff` output as machine-readable:
+
+- Exit 0 → pass; the JSON stdout has `status: "pass"`
+- Exit 1 → fail; the JSON stdout's `uncovered` array lists each `{ file, line, kind }` hit
+- `kind: "uncovered"` → write the missing test
+- `kind: "no-coverage-data"` → entire file isn't in lcov; you shipped untested code (a sibling test file is missing)
+
+Fix every hit before reporting `complete`. If you legitimately can't (e.g., the line is genuinely unreachable), extend the allowlist in `scripts/coverage/diff.mjs` AND add a test in `scripts/coverage/diff.test.mjs` — don't silently bypass.
+
+See `docs/guides/coverage.md` for the full architecture (4 layers) and the troubleshooting section. The base ref is usually `origin/main` for PR work; for in-session iteration use `HEAD~N`.
+
 ## Commit message format
 
 `<type>(<scope>): <imperative subject>`