[Jamyn]

• python-test took 15m51s, 873s of it pytest. The factories commit, so rows accumulate for the length of a run and tests that scan a table get slower the later they run — one file costs 18s alone and 345s in the suite. Now -n auto --dist loadfile with a database per worker: 1188s → 160s locally, same 1586 passed / 59 skipped over three runs.
• Coverage moves to pytest-cov and uploads to Codecov tokenless. coverage run does not follow xdist's worker subprocesses and reported 22%; the real figure is 59%. coverage.run.source no longer counts the test files in their own denominator. Also forces TCP in the postgres readiness probe, which four workers connecting at once makes reachable.
• Operator action: the Protect main ruleset is already repointed at the renamed checks frontend-checks (was frontend-lint-test, which omitted the vite build) and npm-lock-sync (was lockfile-sync, the npm half of a workflow whose other job is python-lock-sync). The six open PRs predate the rename and each needs gh pr update-branch before they can merge.