ci: allow default branch health gates

[saagpatel]

What

• Allow branch-name guard checks to pass for GitHub Actions default-branch checkouts.
• Reuse the shared diff-coverage script from the quality workflow.
• Skip diff coverage on default-branch runs where there is no pull-request base diff.

Why

• core-repo-health was failing on master because the local branch guard treated the CI checkout as direct local work.
• supporting-policy-and-coverage was failing default-branch verification on a diff-coverage gate that is meant for pull-request diffs.

How

• Keep local main/master protection intact, but allow it only when CI=true and GITHUB_ACTIONS=true.
• Centralize diff-coverage behavior in scripts/ci/run-diff-coverage.sh so verify commands and workflow steps agree.

Testing

• pnpm run health:repo:checks && pnpm run health:repo:static
• git diff --check

Performance Impact

• None expected; workflow-only control-flow fix.

Risk / Notes

• Does not resolve transitive Rust dependency alerts pinned by tauri/lancedb; those remain as separate upstream dependency work.