CI: a push runs the tests, a pull request also builds the firmware

Rebuilding both firmwares on every push was more than anyone looked at.
A push now runs the host tests with their coverage (under two minutes);
a pull request adds the release firmware and the Debug Build, and is how
changes reach main; a tag still does everything before it releases.
Pull requests from forks don't run. scripts/ci.sh takes 'tests' or
'builds' for one half; coverage.sh now fails when a test fails.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

scripts/ci.sh

@@ -1,7 +1,14 @@
 #!/usr/bin/env bash
 # Local CI: run host unit tests, then build the firmware.
+# Usage: scripts/ci.sh [tests|builds]   one half only; both by default
 set -euo pipefail
 source "$(dirname "$0")/_docker.sh"
 DOCKER_EXTRA=()
 
-run_in_container bash -c 'git config --global --add safe.directory "$PWD" && pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug'
+case "${1:-all}" in
+    tests) STEPS='pio test -e native' ;;
+    builds) STEPS='pio run -e cardputer-adv -e cardputer-adv-debug' ;;
+    all) STEPS='pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug' ;;
+    *) echo "Usage: scripts/ci.sh [tests|builds]" >&2; exit 1 ;;
+esac
+run_in_container bash -c 'git config --global --add safe.directory "$PWD" && '"$STEPS"

scripts/coverage.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# How much of lib/ the host tests run: builds them with coverage counters, runs them, and reports.
+# Runs the host tests and says how much of lib/ they run: they're built with coverage counters.
 # Usage: scripts/coverage.sh [out folder, default .pio/coverage]
 # Out: summary.json (gcovr), coverage.svg (the README's badge), index.html (line by line).
 # What it measures: the lines of lib/ that compile on a PC. Not lib/SD (the card's driver) and not
@@ -10,7 +10,7 @@ DOCKER_EXTRA=()
 OUT="${1:-.pio/coverage}"
 
 run_in_container bash -c '
-    set -e
+    set -eo pipefail  # a failing test fails this script, tail or not
     git config --global --add safe.directory "$PWD"
     rm -rf .pio/build/native-coverage "'"$OUT"'"
     mkdir -p "'"$OUT"'"