The required OpenCode coverage job starts its pull-request sandbox with --network=none, then attempts apt and cargo installs inside that sandbox. Current-head reviews therefore fail before they can produce trustworthy coverage evidence.
Acceptance criteria:
- Build coverage tooling from the trusted default-branch workflow before PR source is mounted.
- Keep the actual PR execution container networkless and capability-restricted.
- Pin and verify non-distribution artifacts.
- Preserve hash-locked Python tooling.
- Add contract coverage and prove the hosted-runner path on the exact PR head.
The required OpenCode coverage job starts its pull-request sandbox with
--network=none, then attempts apt and cargo installs inside that sandbox. Current-head reviews therefore fail before they can produce trustworthy coverage evidence.Acceptance criteria: