ci: report this build's coverage and benchmarks

The pipeline built and published an apk and said nothing about the code it
packaged. It now runs the suite as `make cover COVERPROFILE=$HOME/cover.out`
and POSTs the profile to cov.srht.bigb.es under ~bigbes/sr-ht-compare — the
name on the sources: line, not the renamed service's.

`cover` is not a second suite: it is `test` with two flags reached through
TESTFLAGS, so CI's command and a developer's `make test` cannot become two
different runs. -covermode=atomic because this is a concurrent server and the
default set mode records that a statement ran rather than how often.

There was nothing to upload to bench.sr.ht either, gitx having no benchmark at
all. The diffing path — what a request here is actually spent in — now has
five: Diff in both of the grammars a compare URL can carry, DiffStat,
CommitPatch, and the two pure functions under them, mapFilePatches and
cutPatch. They build their own fixture, 40 files of 120 lines with a branch
that diverged, because the test fixture's dozen lines measure opening a
repository rather than diffing one.

`make -s bench` writes benchfmt to $HOME/bench.txt and three greps refuse to
upload a file the expected names are missing from: `go test -bench` that
matches nothing prints ok and exits 0, and an empty file is valid benchfmt.
Both uploads turn tracing off around the token, use --fail-with-body so a
refusal is printed and still fatal, and strip both ref prefixes because this
pipeline builds tags too.

cover.out and bench.txt are declared as artifacts, so a failed upload leaves
the report recoverable, and gitignored, because written into the checkout they
would stamp the packaged binary +dirty.

The manifest is now within 560 bytes of the 16 KiB a submission may carry; the
reasoning lives in docs/ci.md, which says so.