fix(go-coverage): embed default .ignorecoverunit in shared workflow module

[gandalf-at-lerian]

Context

The go-pr-analysis and related coverage workflows support a .ignorecoverunit file at repo root to exclude paths from unit test coverage reporting (mocks, E2E tests, bootstrap code, generated files, etc.).

Some repos already adopt this pattern manually (e.g. access-manager, tracer, lib-auth), but there is no default provided by the shared module — every repo must create and maintain its own file.

Current behavior

Coverage jobs report false low coverage on paths that don't need unit tests (auto-generated mocks, E2E suites, bootstrap/cmd entrypoints, generated API docs). Teams have to discover the .ignorecoverunit pattern on their own.

Expected behavior

The shared workflow module should ship a sensible default .ignorecoverunit so all repos immediately ignore the most common non-unit-testable paths, reducing noise and avoiding repeated per-repo config.

Suggested default patterns

# Auto-generated mocks
*_mock.go

# Bootstrap / entrypoints
/bootstrap/
/cmd/
bootstrap.go

# Generated API docs
/api/

# E2E and integration test directories
/test/e2e/
/tests/e2e/

# Testutil helpers
/internal/testutil/

Reference

• access-manager/.ignorecoverunit — existing example
• tracer/.ignorecoverunit, lib-auth/.ignorecoverunit — other repos already doing this

Proposed solution

Embed the default .ignorecoverunit inside the shared workflow module so it is applied automatically when a repo does not provide its own, or alternatively commit a canonical default to shared-workflows that repos can pull via the workflow.

Repos that already have their own .ignorecoverunit should keep precedence (local overrides default).

---

Requested-by: @qnen, @bedatty