Add bisect_ppx test coverage infrastructure with CI workflow and test suites

Integrate bisect_ppx for code coverage across the test suite:

- Add bisect_ppx instrumentation to lib/dune and test/dune
- Add bisect_ppx dependency to dune-project, nixtamal.opam, and nix/package/nixtamal.nix
- Create bisect.yml configuration for HTML and text coverage reports
- Add .github/workflows/coverage.yml for CI-based coverage reporting
- Fix flake.nix devShell to include checkInputs for full development environment
- Add coverage checks to flake.nix checks output

New test suites for recently ported features:
- test/test_upgrade.ml: Tests for schema upgrade command (backup, dry-run, version validation)
- test/test_fossil.ml: Tests for Fossil VCS codec and lockfile roundtrips
- test/test_lockfile.ml: Tests for lockfile auto-creation and serialization
- test/test_main.ml: Register all new test suites

Documentation updates:
- AGENTS.md: Add contact info (website, XMPP MUC), note llm/ folder is gitignored
- README.asciidoc: Add website link, mention Fossil VCS, schema versioning, upgrade command
- .gitignore: Add _build/ and _coverage/ directories

Covers testing for previously ported features: schema upgrade, Fossil VCS support,
and lockfile auto-creation.

1 files changed, 71 insertions, 0 deletions

diff --git a/test/test_lockfile.ml b/test/test_lockfile.ml
new file mode 100644
index 0000000..8d5f92b
--- /dev/null
+++ b/test/test_lockfile.ml
@@ -0,0 +1,71 @@
+(*─────────────────────────────────────────────────────────────────────────────┐
+│ SPDX-FileCopyrightText: 2026 toastal <https://toast.al/contact/>             │
+│ SPDX-License-Identifier: LGPL-2.1-or-later WITH OCaml-LGPL-linking-exception │
+└─────────────────────────────────────────────────────────────────────────────*)
+open Alcotest
+open Nixtamal
+
+let write_file path content =
+	Eio.Path.with_open_out ~create:(`Or_truncate 0o644) path @@ fun flow ->
+	Eio.Flow.copy_string content flow
+
+let setup_workdir ~env name =
+	let cwd = Eio.Stdenv.cwd env in
+	let dir = Eio.Path.(cwd / "_build" / "tests" / name) in
+	(
+		match Eio.Path.kind ~follow:true dir with
+		| `Not_found -> ()
+		| _ -> Eio.Path.rmtree dir
+	);
+	Eio.Path.mkdirs ~perm:0o755 dir;
+	Working_directory.set ~directory:dir;
+	dir
+
+let write_minimal_manifest ~version dir =
+	let content = Fmt.str {|version "%s"
+inputs {}
+|} version in
+	write_file Eio.Path.(dir / Manifest.filename) content
+
+let suite =
+	[
+		test_case "Lockfile auto-creation from manifest" `Quick (fun () ->
+			Eio_main.run @@ fun env ->
+			let dir = setup_workdir ~env "lockfile-auto-create" in
+			write_minimal_manifest ~version:"0.1.1" dir;
+			Lockfile.lockfile := None;
+			let res = read_manifest_and_lockfile () in
+			check bool "manifest and lock read succeeds" true (Result.is_ok res);
+			check bool "lockfile was created in memory" true (Option.is_some !Lockfile.lockfile)
+		);
+		test_case "Lockfile write/read roundtrip" `Quick (fun () ->
+			Eio_main.run @@ fun env ->
+			let dir = setup_workdir ~env "lockfile-roundtrip" in
+			write_minimal_manifest ~version:"0.1.1" dir;
+			let name = Name.Name.make "lockfile-roundtrip-input" in
+			let input =
+				Input.make
+					~name
+					~kind:(Input.make_kind_file ~url:(Input.Template.make "https://example.org/archive.tar.gz") ())
+					()
+			in
+			ignore (Input_foreman.add name input);
+			let made =
+				match Lockfile.make ~version:"0.1.1" () with
+				| Ok lock -> lock
+				| Error err -> failf "Failed to make lockfile: %s" (Fmt.str "%a" Error.pp_lockfile_error err)
+			in
+			check bool "write succeeds" true (Result.is_ok (Lockfile.write ()));
+			let reread =
+				match Lockfile.read () with
+				| Ok (Some lock) -> lock
+				| Ok None -> fail "Expected lockfile on disk"
+				| Error err -> failf "Failed to read lockfile: %s" err
+			in
+			check
+				(testable Lockfile.pp Lockfile.equal)
+				"serialized lockfile roundtrips"
+				made
+				reread
+		);
+	]