fix(ci): produce required Codecov status for contributor forks

[ty-everett]

Program and scope

Fork contributor PRs cannot satisfy the required codecov/patch status because CI explicitly skips upload, report processing and notifications for forks. #539 demonstrates the deadlock: its repository-owned coverage check and complete merge gate pass, but the required Codecov status never exists. Run all three steps for nonempty coverage using the pinned Codecov action's supported tokenless public-fork mode.

Coordination: #558. Related: #402, #539, #550. This changes no package/runtime bytes or dependency.

Verification and security

• Full workspace build, pnpm health:check, lint, format and typecheck passed on Node 24.18.0 / pnpm 10.33.2.
• Added a regression contract covering all three required reporting steps and preserving the ordinary pull_request event, lack of OIDC/write permissions, and repository-owned patch-coverage gate.
• Public fork jobs receive no repository secrets. No pull_request_target, workflow_run artifact execution or additional permissions are introduced. Same-repository upload behavior is unchanged.
• The action remains pinned to the existing audited commit. Tokenless fork support is documented by Codecov.
• Complete diff self-reviewed for correctness, trust boundary, permissions, compatibility, docs and operational effects.
• No dependency, package version, migration or deployment change; no suppressed finding or weakened coverage threshold.
• Hosted exact-head CI 35808466745, CodeQL, zero-new-Sonar findings, Codecov patch and all other applicable checks passed at 9f652248dc9e1a88fbf24ab36f07e21f97e7ff89; no open merge-ref CodeQL alerts or unresolved review threads.

Completion evidence

After this CI repair is integrated, update the contributor PRs to current main and verify actual fork uploads, processing and codecov/patch status before merging them. A passing same-repository run alone cannot prove the fork path.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!