coverage: count dead branches inside executed functions as unused

[soulgalore]

--chrome.coverage ships V8's detailed (block-level) coverage data, but the JS used-bytes calculation took the union of every range whose count was
greater than zero. V8 returns nested ranges: an outer range over the function body and inner ranges over sub-blocks. If a function ran at all, its
outer range has count > 0 and already covers the whole body — inner count == 0 ranges (the actual dead branches) get absorbed into the union and
contribute nothing.

The visible effect on real sites is that any function that executed even once reports zero unused bytes. On modern bundles where module-evaluation
top-level code runs for almost every function, the per-script unused-% collapses to roughly zero across the board. Downstream consumers like
sitespeed.io render the data faithfully and end up with a "0 B unused" column on pages that obviously ship plenty of dead code, making the feature
misleading.

Switch to a nested-interval walk: collect every range from every function, sort outer-first (start ascending, length descending), and paint a per-byte
flag where each range overwrites the previous. The innermost range's count wins at every byte, which is the same definition Chrome DevTools' Coverage
panel uses. Outer "function called" ranges no longer mask inner "branch never taken" ranges, so dead branches inside executed functions show up
correctly.

CSS rule-usage tracking returns flat, non-overlapping ranges and continues to use unionLength unchanged.

Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com

Change-Id: I847673d9859f0e2aec1164c045d7f0b47c4816b5