ci: run e2e on develop pushes; ratchet + extend coverage floors

[LukasWodka]

Summary

e2e on develop pushes (#293). Scheduled workflows always execute the default branch's tree — main, currently ~46 commits behind develop. discovery_e2e_test.go, delete_e2e_test.go, and the whole delete-teardown job don't exist on main, so the nightly has never actually run them (the TokenRequest/offboard e2e included). This adds push: branches: [develop] to e2e.yml (existing schedule / dispatch / labeled-PR triggers kept), so the suite runs against the tree the tests were written for.

Coverage floor ratchet (#294). Bumps the two existing floors to just under current develop numbers and adds the two load-bearing packages that had no floor (internal/push is the 6.3k-LOC money path):

package	floor	current (unit, as coverage-floor.sh measures, ubuntu CI runner)
internal/cli	68 -> 80	82.9%
internal/submit	72 -> 78	80.4%
internal/push	87 (new)	89.0%
internal/cluster	73 (new)	74.6%

Deviation from the ticket:internal/cluster gets 73, not the proposed 75. Its coverage is environment-dependent — the kubeconfig-resolution paths only execute on a machine with a real ~/.kube/config, so a dev laptop reads 78.5% while the bare CI runner reads 74.6% (caught by this PR's own first CI run). The floor gates on CI, so it's set to CI-actual − 1, per the ratchet policy. Documented in the script header.

Also updates the one-line step name in build.yml ("cli, submit, push, cluster must not rot") so it doesn't misname the floor set — expected trivial rebase vs sibling PRs touching this file — merge order flexible.

Test plan

Ran locally:

• ./scripts/coverage-floor.sh — all four floors pass locally; first CI run then failed on internal/cluster (74.6% on the runner vs 78.5% locally), floor corrected to 73 — CI green is the real verification here.
• YAML parse check on e2e.yml + build.yml.

NOT run locally: the e2e suite itself (needs kind/k3d); the new push trigger will exercise it on the first merge to develop.

Fixes#293
Fixes#294

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only workflow and coverage-threshold changes; no runtime product behavior.

Overview
e2e on develop pushes (#293). Adds a push trigger on develop to the integration workflow so kind/k3d suites run against the branch where newer tests (discovery, delete, offboard teardown) actually live. Scheduled runs still use the default branch (main), which had been skipping that work; schedule, manual dispatch, and label-gated PR runs are unchanged.

Coverage ratchet (#294). Raises floors for internal/cli (80) and internal/submit (78) and adds floors for internal/push (87) and internal/cluster (73). The script header documents current CI percentages and sets internal/cluster from the bare Ubuntu runner (not a laptop with kubeconfig). The Build workflow step label is updated to mention all four gated packages.

^{Reviewed by Cursor Bugbot for commit d1d82e2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 37 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#181 — feat(weights): normalize-on-read — mixed cycles average instead of rejecting (SEC-03 §8 step 2) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · no reviewer assigned
• backend#1079 — feat(global_meta): edge dataset_meta exposure + attributes contract at ingest (#924 G4a) · author: @divyasinghds · no reviewer assigned
• backend#1086 — docs(rfc): SafeTensors weight-format migration — SEC-03 Phase 1 (RFC 0004) · author: @shujaatTracebloc · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1095 — feat(experiment): configurable preprocessing knobs incl. tabular scaler — RFC 0003 L1 + L1b (#1094) · author: @LukasWodka · no reviewer assigned
• backend#1100 — fix(boot): pin SDK install to tracebloc==0.11.2, drop 404 dev line (#1098) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1105 — perf(api): query micro-fixes — notifications N+1, cached data_scientist, composite index, sampling (#975) · author: @aptracebloc · no reviewer assigned
• cli#266 — main - > enhance CLI features and tests · author: @saadqbal · no reviewer assigned
• cli#278 — fix(deps): toolchain go1.26.5 + x/net v0.57.0 — clear 6 reachable vulns; govulncheck CI gate · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d1d82e2. Configure here.}

[saadqbal]

Nice — floors ratchet up (all set just under the CI numbers, and Test is green so they pass), and the push: develop trigger is the right fix for the schedule-runs-on-main gap. Good catch on the CI-vs-local cluster coverage delta. 👍