ci: report this build's coverage and benchmarks

The pipeline built and published an apk and said nothing about the code it
packaged. It now runs the suite as `make cover COVERPROFILE=$HOME/cover.out`
and POSTs the profile to cov.srht.bigb.es under ~bigbes/sr-ht-compare — the
name on the sources: line, not the renamed service's.

`cover` is not a second suite: it is `test` with two flags reached through
TESTFLAGS, so CI's command and a developer's `make test` cannot become two
different runs. -covermode=atomic because this is a concurrent server and the
default set mode records that a statement ran rather than how often.

There was nothing to upload to bench.sr.ht either, gitx having no benchmark at
all. The diffing path — what a request here is actually spent in — now has
five: Diff in both of the grammars a compare URL can carry, DiffStat,
CommitPatch, and the two pure functions under them, mapFilePatches and
cutPatch. They build their own fixture, 40 files of 120 lines with a branch
that diverged, because the test fixture's dozen lines measure opening a
repository rather than diffing one.

`make -s bench` writes benchfmt to $HOME/bench.txt and three greps refuse to
upload a file the expected names are missing from: `go test -bench` that
matches nothing prints ok and exits 0, and an empty file is valid benchfmt.
Both uploads turn tracing off around the token, use --fail-with-body so a
refusal is printed and still fatal, and strip both ref prefixes because this
pipeline builds tags too.

cover.out and bench.txt are declared as artifacts, so a failed upload leaves
the report recoverable, and gitignored, because written into the checkout they
would stamp the packaged binary +dirty.

The manifest is now within 560 bytes of the 16 KiB a submission may carry; the
reasoning lives in docs/ci.md, which says so.

gitx: repository access and ref-to-ref diffs on go-git

Implement the git access layer for compare.sr.ht on go-git v5 (no runtime
git binary). Public surface: Open (owner/name validated via core, bare-repo
HEAD check, ErrNotFound on any miss); Refs/DefaultBranch; ResolveCommit/Log/
Parents; Diff/RawDiff/DiffStat/MergeBase/CommitPatch.

- Diffs route through DiffTreeWithOptions(DetectRenames) so old/new tree order
  is explicit: three-dot uses the merge base as old side, two-dot uses base;
  CommitPatch diffs a commit against its parent (root vs empty tree, merge vs
  first parent, ParentSHAs exposed for the banner).
- Patch text is generated in memory then capped (5 MiB page, 50 MiB raw,
  injectable override for tests) and cut at a "diff --git" file boundary so the
  browser parser never sees a torn hunk; ctx timeout (10s) guards runaways.
- FileChange status/counts/binary derived purely from go-git FilePatches
  (mapFilePatches); Log excludes base's full reachable set for correct
  base..head semantics.

Tests build fixtures by driving the real git CLI in t.TempDir(). Fidelity gate
(TestPatchFidelity) confirms go-git emits standard git headers — diff --git,
index, rename from/to, "Binary files ... differ", @@ hunks — parseable by the
frontend parsePatchFiles(). 82% coverage.

core validators reject ^/~ so navigation revs are resolved to SHAs in tests.