#3597 feat(coverage): stamp the run that wrote coverage/

Summary

Layer 1 of 3 for #3468. Stack: main ← this PR ← #3609 ← #3598. This layer only writes a record;
the reader is #3609, the verdict switch #3598.

A coverage pass writes coverage/ and nothing inside it says when, so a stale map reads as fresh. This
adds { head, workingTreeHash, runSelection, include, exclude }, written by
vitest-coverage-run-stamp-reporter.ts, shaped by coverage-crap/stamp.ts.

• Hashed at both ends. beginCoverageRun captures HEAD and the tree in onInit, before Vitest
  transforms a test module; finishCoverageRun re-hashes in onFinishedReportCoverage and writes only if
  the two agree. A pass that raced an edit describes neither tree, so it attests nothing.
• Whole non-ignored tree, by path and bytes, so editing a test file invalidates it.
• full rests on positive evidence: allowOnly === false, no name pattern, tag filter, shard, selected
  test ids, --exclude or --dir, every instrumented project, and every file its globs name. The last two
  come from the resolved config: Vitest folds them into the globs, so no file comparison sees them.

Nothing is deleted on refusal: a pass cannot tell an earlier pass's record from a concurrent pass's, and
Vitest wipes the reports directory per pass anyway. vitest.config.ts owns the lane split and the
uninstrumented project list the reporter reads.

Validation

pnpm check:affected --run exit 0 (63 checks) at 823e51734, foreground, under the gate lock. Six
mutations killed: the end-of-run comparison, allowOnly, the onInit capture, the delete,
--allowOnly=false, and the --exclude/--dir check. A real --exclude 'packages/**' pass here stamps
files, not full.