Fix config-path defaults + implement baseline config-drift detection (plus CI & LICENSE)

[howdu]

Summary

Full review of the plugin. The core is well-structured and well-tested (the render-collector approach via a wildcard View::composer('*'), the hash baseline, and the parallel-shard merge are all solid). This PR fixes two concrete issues I could verify, and adds two pieces of missing project infrastructure. Each is a separate, revertable commit.

1. fix(config) — config-path defaults + drift detection

Bug: empty/non-string baseline/cache collapse to the project root.
BladeCoverageConfig::stringValue() returned '' for an empty string or any non-string value, and the ?? 'default' chain only triggers on null. So ['baseline' => ''] (or an array/int) resolved the baseline path to the project root directory:

empty baseline => /srv/app        (expected /srv/app/tests/BladeCoverage/baseline.json)
empty cache    => /srv/app        (expected /srv/app/.cache/pest-blade-coverage)

That silently breaks baseline load (is_file() on a directory → empty baseline, every view treated as new) and write (file_put_contents on a directory → throws). Now non-empty-string values fall back to the documented defaults.

Gap: config.hash was written but never read. The README says the baseline "stores metadata that helps catch accidental config drift," but nothing compared it — confirmed by grep, the key was write-only. This PR:

• centralises the fingerprint on BladeCoverageConfig::fingerprint() (single source of truth, used by write()),
• reads it back via BladeCoverageBaseline::loadConfigHash() (tolerant of legacy path-to-hash baselines, which return null),
• emits a non-failing yellow warning on a normal run when the current include/exclude config no longer matches the baseline's stored fingerprint.

Exit codes are unchanged; legacy baselines are unaffected.

2. ci — GitHub Actions workflow

There was no CI. Added a matrix (PHP 8.3/8.4 × prefer-lowest/prefer-stable) running Pest, plus a Pint style check.

3. docs — LICENSE file

composer.json declares MIT but no LICENSE file existed. Added the standard MIT text.

Testing

• vendor/bin/pest — 19 passed (was 16; added 3 tests: default fallback, fingerprint round-trip/drift, legacy-baseline loadConfigHash).
• vendor/bin/pint --test — passes.

Further observations (not changed here — happy to follow up if wanted)

• JSON report after --update-baseline: the report is built from the pre-update evaluation, so it can show "failed": true with newUncovered entries immediately after a successful baseline refresh (the console output correctly suppresses this). A CI step consuming the JSON could misread it.
• scanRoots footgun: an include pattern with no literal prefix (e.g. */views/*.blade.php) yields an empty prefix and recursively scans the entire project root (incl. vendor/, node_modules/). Worth a guard or a documented warning.
• Repo description / README framing: the tool tracks render reach (was a view rendered at all), not line coverage, so "fills the gap left by PHP line coverage" slightly oversells granularity — it fills a different (still real) gap. Not changed since it's mostly the GitHub description rather than the repo.

🤖 Generated with Claude Code