👷 Publish tag coverage to the pages server

The build job bind-mounts the shared pages tree (the runner whitelists it
via container.valid_volumes) and, on tag pushes, wipes
/data/gitea-pages/<owner>/<repo>/<tag>/coverage before copying the c8 report
into it. Only this tag's coverage/ is touched; older tags and sibling
docs/landing trees are left for manual pruning.

Add a `tags: ["*"]` push trigger: a `branches` filter alone matches no tag
ref, so the tag-gated publish job (and this coverage step) could never run.

Track per-branch coverage as a backlog task.

.gitea/workflows/ci.yml

@@ -3,6 +3,10 @@ name: CI
 on:
     push:
         branches: [main]
+        # Releases are tag pushes (`scripts/release.sh` tags bare `x.y.z`). A
+        # `branches` filter alone matches no tag ref, so without this both the
+        # tag-gated `publish` job and the coverage publish step never fire.
+        tags: ["*"]
     pull_request:
         branches: [main]
     workflow_dispatch: {}
@@ -10,6 +14,13 @@ on:
 jobs:
     build:
         runs-on: ubuntu-latest
+        # Bind-mount the shared pages tree so the coverage step below can write
+        # into it. The runner whitelists this path via `container.valid_volumes`
+        # (docker-space `setup/gitea.sh`); `image` is omitted on purpose so the
+        # runner keeps using its default job image.
+        container:
+            volumes:
+                - /data/gitea-pages:/data/gitea-pages
         steps:
             - uses: actions/checkout@v4
             - uses: actions/setup-node@v4
@@ -20,6 +31,23 @@ jobs:
             - run: npm run build
             - run: npm run check
             - run: npm run test:ci
+            # Publish this tag's coverage to the self-hosted pages server,
+            # served read-only at
+            # https://pages.e1nsnull.de/<owner>/<repo>/<tag>/coverage/. Wipe only
+            # this tag's `coverage/`, so sibling docs/landing trees and older
+            # tags survive; pruning stale tags is a manual chore.
+            - name: Publish coverage to the pages server
+              if: startsWith(gitea.ref, 'refs/tags/')
+              env:
+                  REPO: ${{ github.repository }}
+                  REF: ${{ gitea.ref }}
+              run: |
+                  TAG="${REF#refs/tags/}"
+                  DEST="/data/gitea-pages/${REPO}/${TAG}/coverage"
+                  rm -rf "${DEST}"
+                  mkdir -p "${DEST}"
+                  cp -R coverage/. "${DEST}/"
+                  echo "Coverage: https://pages.e1nsnull.de/${REPO}/${TAG}/coverage/"
             # Fast, offline packaging gate. `attw` stays in `publish` (it needs
             # a pack + full resolution matrix); `publint` packs too but is cheap
             # enough to run on every push so a packaging break fails here, not