fix(scripts): add app and sentry-init exclusions to coverage diff gate

Apps (web-next, web-tanstack, cms) do not configure @vitest/coverage-v8
so their source files never appear in the merged lcov; gate them out of
the cover-the-diff check.

core-shared/src/instrumentation/sentry/** is explicitly excluded from
per-package vitest coverage (see core-shared/vitest.config.ts) — exclude
from the diff gate to mirror that decision.

Adds tests for both new exclusion patterns.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/coverage/diff.mjs

@@ -68,6 +68,14 @@ const ALLOWED_GLOBS = [
   // Tooling packages that don't generate a vitest lcov (no @vitest/coverage-v8)
   /^packages\/core-testing\//,
   /^packages\/core-eslint\//,
+  // App packages (web-next, web-tanstack, cms) do not configure
+  // @vitest/coverage-v8, so their source files never appear in the merged lcov.
+  /^apps\//,
+  // core-shared Sentry client init files — explicitly excluded from per-package
+  // vitest coverage in core-shared/vitest.config.ts ("Sentry client init —
+  // browser/node SDK init, tested in apps"); they have test files but coverage
+  // is excluded by design (browser SDK calls, not unit-testable in isolation).
+  /\/instrumentation\/sentry\//,
   // Pure type-alias / interface files (no executable code)
   /\.d\.ts$/, // ambient declaration files — no runtime code by definition
   /\.interface\.ts$/,