ci: make coverage reporting actually work without a secret

[lonhutt]

Problem

The Codecov step was reporting success while silently failing. From the run log on main:

 -> Token length: 0
info  -- Found 1 coverage files to report
error -- Upload queued for processing failed:
         {"message":"Token required - not valid tokenless upload"}
##[end-action outcome=success;conclusion=success]

fail_ci_if_error: false was chosen so a missing secret couldn't redden the matrix — but it turned a real failure into an invisible one. No coverage has ever been published, despite a green check on every run.

That's the same silent-misconfiguration class this project exists to catch, so it shouldn't be shipping in our own CI.

Change

Coverage reporting now needs no secret and no third-party service:

• the total lands in the job summary and the step log
• coverage.out is uploaded as a build artifact

Codecov is kept for trend data, but gated on the token actually being present, so it visibly skips rather than invisibly failing. The secret is mapped to job-level env because the secrets context isn't available in a step-level if.

Verification

• actionlint clean
• Coverage tooling verified locally against a tree with no test files: go test -covermode=atomic produces a valid profile and go tool cover -func reports total: 0.0% rather than erroring
• This PR is also the first exercise of the pull_request trigger — DCL-02's AC-1 requires all six legs green "on push and PR", and only the push half had evidence until now

🤖 Generated with Claude Code

https://claude.ai/code/session_014Ug1TBaLJkUd3dP9SNAaoD