make: coverage-combined — merge unit-test and smoke covdata

Unit tests and the smoke suite cover different halves of the
codebase: unit for pure-Go branching (error paths, parsers, handler
wiring); smoke for the sudo / firecracker / dm-snap / real-KVM paths
unit tests physically can't reach. Separate reports each tell half
the story.

`make coverage-combined` runs the unit suite with
`-test.gocoverdir` pointed at a fresh binary-format dir, then
merges it with the existing smoke covdata via `go tool covdata
merge`. Modes must match; smoke uses the default 'set', so the
unit run aligns by NOT passing -covermode=atomic.

Output matches the existing `make coverage` layout (per-package
list + total) so the two targets read the same in CI.

`make coverage-combined-html` also emits an HTML report at
build/combined.cover.html for clicking through the uncovered
lines that neither suite touches.

Combined total right now: 72.7% (vs 37.7% unit-only / 49% daemon
via smoke).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -21,4 +21,8 @@ id_rsa
 /todos
 /coverage.out
 /coverage.html
+/build/unit/
+/build/combined/
+/build/combined.cover.out
+/build/combined.cover.html
 /.codex