Invoke-MSTestWithCoverage.ps1 asserts coverage threshold before Set-Content, leaving the raw un-post-processed Cobertura on disk when the gate fails

[drmoisan]

Summary

scripts/vscode/Invoke-MSTestWithCoverage.ps1 asserts the coverage threshold before it writes the
post-processed Cobertura document to disk. When the assertion fails, the script throws and the
post-processed document is discarded, leaving the raw un-post-processed document at the output path.

Detail

At scripts/vscode/Invoke-MSTestWithCoverage.ps1:341-343 the threshold assertion runs ahead of the
Set-Content that persists the post-processed XML. The ordering inverts the intended behaviour in
the failing case:

• Intended: the artifact on disk is the document the gate judged.
• Actual on failure: the artifact on disk is the raw dotnet-coverage output — absolute paths,
  third-party packages included, unmerged duplicate classes, and the double-counted line totals that
  Cobertura post-processing double-counts <line> nodes, inflating lines-valid and every coverage rate #441 corrected.

Impact

Only the failure path is affected; a passing run writes the correct document. But the failure path is
exactly when someone reads the artifact to diagnose the shortfall, and what they find is a document
with different numbers than the one that produced the failure message. It also means a failed gate
leaves behind an artifact that, if fed to any downstream consumer, reports the pre-#441 inflated
denominator.

Suggested resolution

Move the Set-Content above the assertion so the judged document is persisted before the threshold
is evaluated. This is a statement reorder, not a logic change, and should be covered by a Pester test
asserting that a sub-threshold run still leaves the post-processed document on disk.

Found during the build-ci-coverage-gate-fidelity epic fan-in review; identified independently by
two review passes.