test(quality): promote overlay coverage to core gate

docs/EXECUTION_BOARD.md

@@ -2076,5 +2076,61 @@
   - `internal/app`
   - `internal/routing`
   - `internal/store/sqlite`
-- 剩余 `watch` 候选只剩：
+
+## 2026-05-30 已将 internal/overlay 从 watch 提升为 core
+
+**目标**：把 overlay patch 执行层纳入硬门槛。虽然它是工具包，但它直接决定：
+
+- host overlay patch 是否真正打到输出目录
+- overlay metadata 是否正确落盘
+- patch 产物是否污染源目录或 `.git`
+
+这层一旦回归，影响的是部署产物正确性，不适合继续只做观察告警
+
+**评估结果**：
+
+- `go test -coverprofile=/tmp/internal-overlay.cover ./internal/overlay` => `coverage: 71.6% of statements`
+- 现有测试覆盖面已包含：
+  - `Apply` 的正常 patch 流
+  - 相对 `pack dir` 支持
+  - nested output dir 拒绝
+  - missing patch 拒绝
+  - metadata 写入
+  - `.git` 过滤
+  - symlink 保留
+- 当前低覆盖点主要集中在：
+  - `applyPatchFile`
+  - `Apply`
+  - `copyFile`
+- 这些缺口主要是错误分支与 IO 边角，不影响把该包提升为 `core`，因为关键 overlay 主路径和最容易出事故的文件系统行为已经有测试覆盖
+
+**本次调整**：
+
+- `tests/quality/coverage_thresholds.tsv`
+  - `internal/overlay`
+    - tier：`watch -> core`
+    - threshold：`70.0` 保持不变
+
+**验证结果**：
+
+- `gofmt -l .` => clean
+- `go vet ./...` => `ok`
+- `go test -cover ./internal/...` => `ok`
+- `go test ./tests/integration/... -count=1` => `ok`
+- `bash ./scripts/test/verify_quality_gates.sh` => `PASS`
+- 统一门禁回读：
+  - `internal/overlay = 71.6%`
+  - 高于新的 `core` 门槛 `70.0%`
+
+**结论**：
+
+- `internal/overlay` 已完成第四批 `watch -> core` 升级
+- 当前覆盖率治理中的显式 `watch` 包已清零
+- 当前 `core` 包集合变为：
+  - `internal/access`
+  - `internal/pack`
+  - `internal/provision`
+  - `internal/app`
+  - `internal/routing`
+  - `internal/store/sqlite`
   - `internal/overlay`

tests/quality/coverage_thresholds.tsv

@@ -3,6 +3,6 @@ internal/access	core	70.0	core access closure logic
 internal/pack	core	70.0	pack loading and validation
 internal/provision	core	70.0	provider import orchestration
 internal/app	core	70.0	HTTP control plane is now above 70 and must stay as a hard gate
-internal/overlay	watch	70.0	utility package should stay above a healthy baseline
+internal/overlay	core	70.0	overlay patch execution affects real deployment artifacts and must stay as a hard gate
 internal/routing	core	70.0	route resolve and sticky runtime are product-critical and must stay above the hard gate
 internal/store/sqlite	core	75.0	sqlite repo layer is high leverage and must stay as a hard gate