test: enforce model and CLI boundary contracts

.github/workflows/ci.yml

@@ -234,6 +234,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -275,11 +277,20 @@ jobs:
             --cov-report="json:test-results/coverage-py${{ matrix.python-version }}.json"
 
       - name: Enforce line and branch coverage floors
+        env:
+          COVERAGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: >-
           "$TEST_ENV/bin/python" scripts/check_coverage_thresholds.py
           "test-results/coverage-py${{ matrix.python-version }}.json"
-          --min-line 49
-          --min-branch 36
+          --min-line 55
+          --min-branch 42
+          --min-file obliteratus/device.py=70
+          --min-file obliteratus/models/loader.py=70
+          --min-file obliteratus/architecture_profiles.py=70
+          --min-file obliteratus/cli.py=70
+          --min-file obliteratus/mlx_backend.py=70
+          --min-changed 90
+          --base-ref "$COVERAGE_BASE"
 
       - name: Upload test and coverage evidence
         if: always()