Codecov uploads authenticate by OIDC

## Summary

The `codecov` job authenticates its uploads with an OIDC token from GitHub instead of the stored `CODECOV_TOKEN` secret.

## Motivation

The job sets `CODECOV_TOKEN` as job-level `env`, so both `codecov/codecov-action` and `codecov/test-results-action` pick the secret up implicitly. `alunduil-chezmoi` uploads with `use_oidc: true` instead, which leaves no upload token to store, rotate, or leak, and `alunduil/zfs-replicate#687` adopts the same. Converging the rest gives the repositories one Codecov pattern.

## Scope

- Add `id-token: write` to the `codecov` job's `permissions`, alongside `contents: read` for checkout.
- Drop the job-level `env: CODECOV_TOKEN` block.
- Pass `use_oidc: true` to both the coverage upload and the test-results upload.
- Delete the `CODECOV_TOKEN` secret once no workflow reads it. That secret lives wherever `alunduil-infrastructure` manages this repository, so it's a change there.

## Acceptance criteria

- [ ] `ci.yml` names no Codecov secret.
- [ ] A pull request run shows both the coverage report and the test-results upload arriving at Codecov.

## Additional context

- Reference: the `shell-tests` job in `alunduil-chezmoi`'s `ci.yml`.
- A fork's pull request gets a read-only `GITHUB_TOKEN`, so `id-token: write` is unavailable there and the upload fails. Secrets are withheld from fork pull requests too, so the token this replaces fails the same way; `fail_ci_if_error: true` is set on both steps, so confirm what a fork's pull request does rather than assuming it is unchanged.
- #294 (Bundle Analysis) would upload to Codecov as well and should use whatever this settles on.