fix(coverage): printf spy no longer breaks coverage collection

[Chemaclass]

🤔 Background

Related #724

Spying or mocking the printf builtin in a test silently dropped all coverage data for that test, because coverage's buffer flush used a bare printf that the test double shadowed — the buffered write went to the spy instead of the coverage data file.

💡 Changes

• Flush the coverage buffer with builtin printf so a user printf spy/mock cannot shadow the write
• Add a regression test asserting flush_buffer still writes when printf is spied