I spent all day today taking notes, making careful experiments, and reading the grcov code and llvm documentation. Finally, I was able to fix the code coverage report for the C API part of librsvg.
I think this may be a bug (in llvm?) when C code gets built with gcov instrumentation (--coverage in clang), but Rust code gets built with rustc's -C instrument-coverage.
Librsvg was using --coverage because that's what meson does when passed -Db_coverage=true. Now we use clang's options directly.