Stabilize Coverity Scan triage and document known false positives

[antonwolfy]

Summary

Coverity Scan runs weekly against mkl_random. The overwhelming majority of findings are in the Cython-generated mklrand.cpp, not in code we maintain — boilerplate artifacts (DEADCODE / UNUSED_VALUE / CHECKED_RETURN) produced by Cython's single-source-for-many-build-configs templating.

We hit a concrete failure mode: a new Cython release regenerated mklrand.cpp, which churned the Coverity CIDs across the generated unit and silently dropped all prior triage on the boilerplate — the whole noise set reappeared under new CID numbers, alongside one new High-severity finding that turned out benign on inspection.

This PR makes triage durable and records the policy so the noise stays filtered while real signal keeps getting reviewed.

Changes

• Pin Cython in the Coverity workflow only (cython==3.3.0 in .github/workflows/coverity.yml). A Cython version bump regenerates mklrand.cpp wholesale (renamed helpers, reshuffled lines), which churns CIDs and their triage; pinning keeps the generated code stable between scans. The pin takes effect because the build runs with --no-build-isolation. Production builds leave Cython unpinned in pyproject.toml, so shipped wheels and Python-version support are unaffected. Bumping the pin is a deliberate act that will require re-triaging the boilerplate.
• Add coverity/README.md, a triage guide with three parts:
  • Policy — where findings come from (generated vs. hand-written), why triage resets, and a review checklist that keeps mkl_random/src/ and __pyx_pf_* bodies in scope rather than blanket-excluding the generated unit.
  • Known findings — the false-positive families with root causes (matched on checker + mechanism, since helper names change across Cython versions), plus the individually verified High-severity _seed_impl OUT_OF_BOUNDS finding (guarded 2-tuple unpack — false positive).
  • Evaluated and declined — why modeling files do not fit, and an opt-in cov-manage-emit hard-exclude left disabled by default.

Rationale

We deliberately do not hard-exclude the generated translation unit: that would also drop the __pyx_pf_* bodies and could hide a genuine .pyx-logic bug. The chosen approach cuts the recurring noise (CID stability via the pin + a documented triage policy) while preserving coverage of the hand-written C++, where a real defect is most likely to appear.

Changelog

Added a Changed entry under [dev].