feat(testing): line coverage via --coverage + bin/x test --coverage (#45)

Instrument each emitted statement with a per-source-line hit counter, gated
behind a new --coverage flag (default off) so ordinary builds — and the
compiler's own self-compile — stay byte-identical and the C-free bootstrap
fixpoint is untouched. A static line table plus a parallel hit-counter array
are dumped at exit through an atexit hook to $LUDIC_COVERAGE (default
ludic.cov) as a `FILE <name>` header and `<line> <hits>` rows.

bin/x test --coverage compiles the test specs with instrumentation, runs them
into per-file dumps, and aggregates a clean per-file line-coverage report that
names the unreached lines. Adds examples/library/coverage.ludic (a spec whose
tests deliberately miss one branch) and docs. Closes the last open acceptance
item of the testing framework (#12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

selfhost/frontend/parse.ludic

@@ -243,7 +243,17 @@ function block() -> Node {
   return b
 }
 
+# parse a statement and stamp it with its source line (the first token's line),
+# unless the specific rule already set one. The line drives --coverage and the
+# panic/expect file:line messages.
 function stmt() -> Node {
+  let ln = toks[pi].line
+  let n = stmt_body()
+  if n.line == 0 { n.line = ln }
+  return n
+}
+
+function stmt_body() -> Node {
   let t = toks[pi]
   if t.kind == TK_ID {
     if (t.text == "let") or (t.text == "var") {