coverage: adapt for root-less containers

There's no sudo, so Ansible's `become` just fails. I'm doing this in an
extra commit so that it's obvious what is upstreamable and what has to
be patched locally due to our funny VM/container setup.

Change-Id: I89b4f59eb9d2612166711f1609637b00fca39cbf
diff --git a/roles/ensure-pycobertura/tasks/main.yaml b/roles/ensure-pycobertura/tasks/main.yaml
index ab309bd..473d543 100644
--- a/roles/ensure-pycobertura/tasks/main.yaml
+++ b/roles/ensure-pycobertura/tasks/main.yaml
@@ -1,4 +1,4 @@
 - name: Ensure pycobertura is available
   pip:
     name: pycobertura
-  become: yes
+    extra_args: --user
diff --git a/roles/pycobertura-diff/tasks/main.yaml b/roles/pycobertura-diff/tasks/main.yaml
index 471c22e..0659d6d 100644
--- a/roles/pycobertura-diff/tasks/main.yaml
+++ b/roles/pycobertura-diff/tasks/main.yaml
@@ -1,6 +1,7 @@
 - name: Generate pycobertura report
   shell: |
     set -ex
+    PATH=${PATH}:~/.local/bin
 
     pycobertura show --format html --output "{{ ansible_user_dir }}/zuul-output/logs/coverage-previous.html" \
       --source "{{ previous_source_prefix }}/{{ zuul.project.canonical_hostname }}/{{ zuul.project.name}}" \