[jiggy-techy]

Summary

Adds coverage reporting to CI so gaps are visible on pull requests.

• Adds a Coverage job using cargo-llvm-cov (LLVM source-based coverage), pinned to a specific action revision.
• Generates target/coverage/lcov.info and a human-readable summary.txt, writes the summary to the GitHub Actions job summary, and uploads both files as the coverage artifact.
• Keeps the coverage floor advisory: continue-on-error: true with COVERAGE_ADVISORY_MIN_LINES currently 0, so coverage is reported without failing PRs while a baseline is established.
• Documents the tool, commands, artifacts, and local workflow in docs/testing.md, with a short pointer from docs/ci.md.

Verification

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace

All pass. The workflow YAML was parsed successfully and the coverage job is present with its seven steps.

Closes #106

MSRV fix

The first CI run showed the existing MSRV (1.85.0) job failing before compilation because the locked dependency set requires Rust 1.88 (wasmparser 0.259, stellar-strkey 0.0.18, serde_with 3.23). This PR now aligns the workspace rust-version and the MSRV job to 1.88.0 so future PRs do not inherit that failure.

Verified with the 1.88.0 toolchain that cargo metadata --locked resolves successfully.

Security audit fix

The RustSec audit job then failed on noyalib 0.0.5 (RUSTSEC-2026-0333), pulled in by the unmaintained serde_yml crate. This PR replaces serde_yml with the maintained serde_yaml_ng fork (same from_str API). cargo tree confirms noyalib and serde_yml are no longer in the dependency graph, and YAML configuration tests still pass.
Local audit verification after the replacement:

cargo audit --file Cargo.lock
  Scanning Cargo.lock for vulnerabilities (181 crate dependencies)
  warning: 1 allowed warning found (unsafe-libyaml unmaintained)
  exit=0

The vulnerable noyalib advisory is gone; only the non-failing warning remains.