docs: cover report --coverage on the npm page and refresh the quality-gate notes (#13)

- `launcher/README.md` (npm page): `report --coverage` usage line and a
paragraph on Istanbul coverage input (lands on npmjs.com with the next
launcher release).
- `docs/quality-gate.md`: the reusable workflow bullets now describe the
opt-in `report` / `coverage-artifact` inputs and the six
caller-controlled inputs; the consumption line mentions the npm launcher
and the `CODE_QUALITY_IMAGE` override.

Fact-checked against the code (a failing `report` step does fail the
job; wording reflects it). No code changes, no release.

Author: Cenadros

docs/quality-gate.md

@@ -75,8 +75,8 @@ Each adapter writes `quality/<adapter-id>-baseline.json` with schema version 1,
 - A reduction-only `baseline` update may write a current snapshot only when there is no regression.
 - `check --initialize` writes a missing snapshot, including an empty findings map, but never replaces an existing snapshot.
 - Tool-version and config-hash mismatches require a reviewed regeneration: remove the affected snapshot and initialize it again.
-- The reusable workflow runs plain `check` and never writes baselines; `GITHUB_ACTIONS=true` also protects the CLI from update, initialize, baseline, and init writes.
-- The reusable workflow accepts only lowercase, space-separated check IDs and fixes its image registry and repository to `ghcr.io/runroom/code-quality`; only `image-tag` is caller-controlled.
+- The reusable workflow runs plain `check` and never writes baselines; `GITHUB_ACTIONS=true` also protects the CLI from update, initialize, baseline, and init writes. With the opt-in `report` input it also runs `code-quality report` after the check (its findings are advisory and never enter the gate, though a failing `report` step still fails the job) and uploads `artifacts/quality` as the `quality-reports` artifact; the optional `coverage-artifact` input downloads a coverage artifact for the Fallow health report.
+- The reusable workflow accepts only lowercase, space-separated check IDs and fixes its image registry and repository to `ghcr.io/runroom/code-quality`; the caller controls only `image-tag`, `checks`, `setup`, `working-directory`, `report`, and `coverage-artifact`, and the coverage artifact name is validated before use.
 - Tool subprocesses inherit only approved environment variables plus constant and invocation-specific tool settings.
 
 The comparison is per key. A reduction in one finding cannot fund an increase in another finding. Native parser errors, unknown records, incomplete reports, invalid paths, and duplicate normalized keys fail closed.
@@ -183,4 +183,4 @@ A tool version bump is a policy change and follows these five steps:
 4. Build and release the new image tags.
 5. Have consumers explicitly regenerate affected snapshots after reviewing the changes; ordinary `--update` is not a tool-version migration mechanism.
 
-The v1 workflow and image are consumed through `@v1` and `v1`. A breaking CLI, snapshot, parser, or policy contract starts a new major line.
+The v1 workflow and image are consumed through `@v1` and `v1`, and the npm launcher `@runroom/code-quality` through `@1`; launcher X.Y.Z runs image vX.Y.Z unless `CODE_QUALITY_IMAGE` overrides it. A breaking CLI, snapshot, parser, or policy contract starts a new major line.

launcher/README.md

@@ -14,6 +14,7 @@ npx @runroom/code-quality init                          # scaffold configuration
 npx @runroom/code-quality check                         # run all configured checks
 npx @runroom/code-quality check complexity duplication  # run selected checks
 npx @runroom/code-quality report                        # generate advisory reports
+npx @runroom/code-quality report --coverage coverage/coverage-final.json  # advisory reports with measured CRAP
 npx @runroom/code-quality doctor                        # verify tools and grammar assets
 npx @runroom/code-quality versions                      # list pinned tool versions
 ```
@@ -28,6 +29,8 @@ docker run --rm -v "$PWD:/work" ghcr.io/runroom/code-quality:vX.Y.Z <args>
 
 `CODE_QUALITY_IMAGE` overrides the image and is validated as an image reference. Set it only to an image you trust because the current directory is mounted read-write into the container.
 
+`report --coverage <path>` (or the `report.coverage` key in `.code-quality.yml`, available from 1.2.0) gives Fallow an Istanbul `coverage-final.json` map, or a directory containing it, so the advisory CRAP values use measured coverage instead of the 0 % estimate. Vitest's `json` coverage reporter writes that format with either the V8 or Istanbul provider; raw V8 output is not supported. The path must be repository-relative and the blocking checks are not affected.
+
 `CI`, `GITHUB_ACTIONS`, `NO_COLOR`, and `FORCE_COLOR` are forwarded to the container. `--color` and `--no-color` override everything; otherwise a non-empty `NO_COLOR` disables color, then `FORCE_COLOR` (any value but `0`) forces it, then color is on in GitHub Actions or when stdout is a TTY.
 
 ## Documentation