coverage: run nightly and keep the report as an artifact

The operator never received a coverage report. The job existed but was
`workflow_dispatch` only, so nothing had ever run it — "there is a CI job
for it" was true and produced nothing.

Its header argued against a schedule: an instrumented build roughly doubles
a test job, and a nightly number nobody reads is farm time for nothing. That
was a cost judgement, and it has been made differently. The comment changes
with the trigger rather than staying to contradict it.

The hour is deliberate: the runner's job capacity defaults to 1
(`services.hyperhive.deploy.forgejo.ci.concurrency`, applied as
`runner.capacity` in nix/host-modules/hive-ci.nix), so at that setting this
job holds the runner for its whole timeout and everything else queues.

`--summary-only` wrote into the run log, which is not a place anyone
receives anything. The summary is now teed to a file and uploaded, so a
scheduled run leaves a report to fetch. `if: always()` keeps the partial
output from a failed run.

`set -o pipefail` is load-bearing: without it the step's status is `tee`'s,
so a failed run would report success and upload an empty report. Verified
that shape rather than assuming it — without the guard a failing pipeline
exits 0, with it 1, and a succeeding one still exits 0.

.forgejo/workflows/coverage.yml

@@ -1,21 +1,18 @@
 name: coverage
 
-# Manual dispatch ONLY — deliberately not on `pull_request`, and
-# deliberately not nightly.
+# Nightly plus manual dispatch. The report is uploaded as an artifact rather
+# than printed into the run log, so a scheduled run leaves something to fetch.
 #
-# A coverage run needs its own instrumented build: it cannot reuse the
-# normal test artifacts, so it roughly doubles a test job. Coverage here
-# answers "do we have glaring holes", which is a question someone asks
-# occasionally — not a gate every PR pays for, and not a number worth
-# spending farm time on every night whether or not anyone reads it.
-# Manual dispatch costs nothing until someone wants the answer.
+# ⚠️ The hour is deliberate: at the default job capacity of 1
+# (`services.hyperhive.deploy.forgejo.ci.concurrency`) this job holds the
+# runner for its whole timeout and everything else queues behind it.
 #
-# Its own file rather than a job in ci.yml: that workflow already has a
-# `workflow_dispatch` trigger (so `hive-forge ci-rerun` can retrigger
-# without an empty commit), and a trigger there fires EVERY job in the
-# file. A coverage job added to ci.yml would run on every pull request.
+# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
+# job in that file, and this must not run per pull request.
 on:
   workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * *"
 
 jobs:
   coverage:
@@ -37,4 +34,16 @@ jobs:
         # nobody runs directly, and the per-crate default would hide
         # exactly those behind a green summary for the one crate someone
         # happened to name.
-        run: nix develop -c cargo llvm-cov --workspace --summary-only
+        #
+        # `pipefail` or the step reports `tee`'s status, and a failed run
+        # uploads an empty report as a success.
+        run: |
+          set -o pipefail
+          nix develop -c cargo llvm-cov --workspace --summary-only | tee coverage-summary.txt
+      - name: keep the report
+        # `always()`: a failed run should still leave its partial output.
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-summary
+          path: coverage-summary.txt