ci(frontend): add core-packages-coverage job to enforce 100% TS coverage

The core:cover Jest script enforces 100% statement/branch/function/line
coverage for packages/**/*.ts but was only run locally. This adds a
dedicated CI job so any PR that drops coverage below 100% fails hard,
without relying on Codecov's carryforward behavior.

After merging, add "core-packages-coverage" to the required status
checks in the master branch protection rules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/superset-frontend.yml

@@ -180,6 +180,24 @@ jobs:
           docker run --rm $TAG bash -c \
           "npm run plugins:build"
 
+  core-packages-coverage:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: |
+          zstd -d < docker-image.tar.zst | docker load
+
+      - name: Enforce 100% TS coverage on core packages
+        run: |
+          docker run --rm $TAG bash -c "npm run core:cover"
+
   test-storybook:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'