Coverage gates for uncovered contracts (batch-sender, vault, asset-policy, governance)

[truthixify]

Tier: M (2-4 days) | Type: test

Context. .github/workflows/coverage.yml runs cargo tarpaulin with --fail-under gates only for stealth-announcer / stealth-registry / stealth-sender at 90% and wraith-names / stealth-splitter at 80%. stealth-batch-sender, stealth-vault, wraith-asset-policy, and the governance PoC have no coverage gate, so tests can regress silently. Batch-sender only has 6 inline snapshot tests and vault has 8, so today's real coverage is likely well below any published bar.

Scope.

• Extend coverage.yml with per-crate tarpaulin runs for the four missing contracts.
• Set gates at 80% for vault / batch-sender / governance and 90% for asset-policy (small surface).
• Backfill tests until each crate meets its gate: for batch-sender that means adding a tests/ dir with adversarial cases beyond the current inline snapshots; for vault that pairs with issue Security audit of stealth-registry Soroban contract #2's hardening tests; for asset-policy add rotation + timelock adversarial cases; for governance add negative-path tests (quorum-not-met, cancelled proposal, executed twice).
• Upload the merged HTML report as a workflow artifact and link it from stellar/README.md.

Acceptance.

• coverage.yml runs tarpaulin for all nine Stellar crates
• Every gate passes on develop
• Coverage HTML artifact linked from stellar/README.md operations section
• Per-crate coverage numbers recorded in contracts/audit-prep/TEST_COVERAGE.md

Files. .github/workflows/coverage.yml, stellar/stealth-batch-sender/tests/ (new), stellar/stealth-vault/tests/ (new), stellar/wraith-asset-policy/tests/ (new), stellar/contracts/governance/tests/ (new), stellar/README.md, contracts/audit-prep/TEST_COVERAGE.md.