chore(ci): refresh coverage-guard.php to the canonical deletion-neutral copy

[rubenvdlinde]

Refreshes scripts/coverage-guard.php from the canonical copy at ConductionNL/.github@main → quality-config/coverage-guard.php. Verbatim copy, no local edits — the shared workflow expects the app copies to be byte-identical to it.

Why now

decidesk's PHPStan-2 PR failed the Guard coverage baseline step, and the guard printed its own diagnosis:

scripts/coverage-guard.php predates --deletion-neutral, so deleting well-tested
dead code will still read as a coverage drop. Copy the canonical version from
ConductionNL/.github at quality-config/coverage-guard.php to pick it up.

The numbers behind that failure:

Changed files, base:    76.68%  (1782/2324 statements)
Changed files, head:    76.49%  (1763/2305 statements)
FAIL: coverage of the files this change touches dropped by 0.19%.

Nineteen statements were deleted and all nineteen were covered. Nothing became less tested — the denominator shrank and took the numerator with it. Read as a percentage that is a regression; read as counts it plainly is not.

That is not a decidesk quirk. Any change that deletes dead code which tests happened to walk through will trip the old guard, and the PHPStan-2 migration deletes exactly that kind of code across the fleet.

Scope of the staleness

I checked all nine PHP apps. Every one ships the same 433-line copy, byte-identical to each other and with zero deletion-neutral hits:

portaliq · larpingapp · openbuild · hermiq · pipelinq · decidesk · doriath · scholiq · shillinq

Since the app copies carry no local customisation, refreshing wholesale is safe — there is nothing app-specific to preserve.

Verification

$ php scripts/coverage-guard.php --capabilities
against
update-baseline
capabilities
changed-files
deletion-neutral      <- new

php -l clean.

What this deliberately does not do

It does not disable the ratchet, baseline it, or relax the threshold. The guard is doing its job on real coverage losses; only its arithmetic for deletions was out of date. A genuine drop still fails after this change.

[github-actions]

Quality Report — ConductionNL/openbuild @ e7f891c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
format		✅
composer			✅	✅ 106/106
npm			✅	✅ 626/626
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-20 23:59 UTC

Download the full PDF report from the workflow artifacts.