D-29: required_coverage frontmatter + PHI inference

---
feature_id: FEAT-studio-qa
---

> D-29 ticket 1: required_coverage frontmatter + PHI inference. Target FEAT-studio-qa-required-coverage (child added via feature-map PR before dispatch).

## Context

(PDT decision-memo lineage; see source line below.)

**Source: PDT D-29 (coverage by construction), ticket 1 of 5.**

## What
Extend feature-map frontmatter parser to accept:
    required_coverage: [<runtime>:<kind>, ...]
Validate declared cells against `TestRuntime` + `TestKind` enums (see `packages/qa/prisma/qa.prisma`).
On admission, if any listed cell fails enum validation, reject with an enumerated error listing the invalid tokens.

## PHI inference sub-AC (Marisol veto scope)
Walk `@PHI` annotations on the feature's declared model set:
- Model set source: feature-map's `models:` frontmatter if present, else Prisma model whose `@feature` annotation matches the FEAT id.
- If any declared model contains an `@PHI` field, force-add `[e2e:security, integration:auth_denied]` to `required_coverage` post-parse.
- Log inference decision to admission report so it's auditable.
- Marisol reviews the inference logic in the PR before ticket 5 (the promotion gate) merges.

## Acceptance Criteria
- [ ] Frontmatter parser accepts `required_coverage:` as an array of `runtime:kind` strings
- [ ] Admission rejects invalid tokens with enumerated error
- [ ] PHI inference walks `@PHI` on declared models and forces two security cells
- [ ] Admission report logs inference decisions
- [ ] Unit test in `packages/qa/src/__tests__/required-coverage.test.ts`

## Feature
FEAT-studio-qa-required-coverage (add via mandatory feature-map + depmap two-PR sequence FIRST before this ticket dispatches)

## Blocked-by
None (independent, dispatches immediately).

## Size / Band
SMALL / assurance.