fix(ci): check_coverage preserves thresholds in --update mode

The preserve-loop that backfills threshold entries for packages not
present in the current coverage profile was gated on `!*update`, which
meant `go run scripts/check_coverage.go --update` with a narrow
coverprofile silently wiped floors for every package not measured.
Discovered while ratcheting wave C with a package-scoped profile.

Move the preserve-loop out of the gate so it runs in both check and
update modes. Narrow profiles now touch only observed packages and
leave the rest untouched.

scripts/check_coverage.go

@@ -220,13 +220,14 @@ func main() {
 		newThresholds[entry.pkg] = current
 	}
 
-	// Also preserve thresholds for packages still in file but not in coverage
-	// (e.g., tests excluded in this run); keep them to avoid false passes.
-	if !*update {
-		for k, v := range thresholds {
-			if _, ok := newThresholds[k]; !ok {
-				newThresholds[k] = v
-			}
+	// Preserve thresholds for packages still in file but absent from the
+	// current coverage profile (e.g., narrow coverprofile, tests excluded in
+	// this run, sqliteonly build tag). This MUST run in both check and
+	// --update modes — otherwise `--update` with a narrow profile silently
+	// wipes floors for all other packages, creating a regression vector.
+	for k, v := range thresholds {
+		if _, ok := newThresholds[k]; !ok {
+			newThresholds[k] = v
 		}
 	}