ci: allow default branch health gates

[saagpatel]

What

• Route the quality workflow diff-coverage step through the existing script.
• Let diff coverage skip on default-branch runs where there is no PR base ref.
• Let the branch-name guard skip default-branch CI checkouts.

Why

• Default-branch health/security scans need to run after merges so GitHub security evidence can refresh.
• The old PR-only assumptions block default-branch CI from completing cleanly.

How

• Centralize diff coverage in scripts/ci/run-diff-coverage.sh.
• Detect default-branch CI by comparing the current branch to the default remote branch.
• Permit main/master only in GitHub Actions CI, while keeping local direct-branch work blocked.

Testing

• Workflow YAML parse passed locally.
• bash -n scripts/ci/run-diff-coverage.sh scripts/git/guard-branch.sh passed locally.

Performance Impact

• None expected at runtime. CI reliability improves for default-branch health gates.

Risk / Notes

• The branch guard remains active for local work and non-default branches. This only relaxes the guard for GitHub Actions default-branch checkouts.