fix: move test coverage collection before packaging phase

Test coverage collection needs access to _deps/ directory to run
`go tool cover -func`, which internally calls `go list` for module
dependency resolution.

Previously (commit cdb2518), test coverage was moved after packaging
to maintain ordering with provenance handling. However, the packaging
phase removes _deps/ for deterministic builds, causing test coverage
to fail with "cannot load module _deps/api-go--lib".

This fix moves test coverage back to before packaging, restoring the
v0.13.2 behavior. This satisfies all requirements:

- Test coverage has access to _deps/ for go list
- SBOM generation has access to _deps/ for scanning
- Packaging removes _deps/ for deterministic tar.gz
- Provenance computes subjects from final artifact (no _deps/)

The build order is now:
1. SBOM generation (needs _deps/)
2. Test coverage collection (needs _deps/)
3. Package phase (removes _deps/)
4. Provenance handling (accurate subjects without _deps/)

Related commits:
- cdb2518: "fix: move provenance handling after packaging phase"
- b5584c5: "Fix go coverage collection by removing deps in packaging"

Co-authored-by: Ona <[email protected]>

Author: leodido

pkg/leeway/build.go

@@ -1058,6 +1058,18 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 		}
 	}
 
+	// Handle test coverage if available (before packaging - needs _deps)
+	if bld.TestCoverage != nil {
+		coverage, funcsWithoutTest, funcsWithTest, err := bld.TestCoverage()
+		if err != nil {
+			return err
+		}
+		pkgRep.TestCoverageAvailable = true
+		pkgRep.TestCoveragePercentage = coverage
+		pkgRep.FunctionsWithoutTest = funcsWithoutTest
+		pkgRep.FunctionsWithTest = funcsWithTest
+	}
+
 	// Package the build results
 	if len(bld.Commands[PackageBuildPhasePackage]) > 0 {
 		if err := executeCommandsForPackage(buildctx, p, builddir, bld.Commands[PackageBuildPhasePackage]); err != nil {
@@ -1080,18 +1092,6 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 		}
 	}
 
-	// Handle test coverage if available
-	if bld.TestCoverage != nil {
-		coverage, funcsWithoutTest, funcsWithTest, err := bld.TestCoverage()
-		if err != nil {
-			return err
-		}
-		pkgRep.TestCoverageAvailable = true
-		pkgRep.TestCoveragePercentage = coverage
-		pkgRep.FunctionsWithoutTest = funcsWithoutTest
-		pkgRep.FunctionsWithTest = funcsWithTest
-	}
-
 	// Register newly built package
 	return buildctx.RegisterNewlyBuilt(p)
 }