Coverage uploads from a pinned Python without rerunning the suite

## Summary

Fix the coveralls step in `ci.yml`. It runs the test suite a second
time, and it uploads only from the matrix leg that is allowed to fail.

## Motivation

From `.github/workflows/ci.yml`:

```yaml
- name: poetry run pytest
run: poetry run pytest
- name: poetry run coveralls
if: matrix.python-version == '3.x'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
poetry run pytest
poetry run coveralls --service=github || poetry run coveralls --service=github-actions
```

Two defects share the one step.

The suite runs twice on the `3.x` leg. The preceding step already
produced `.coverage`, so the repeat inside the coveralls step doubles
the slowest job's runtime and adds no signal.

Upload is gated on `matrix.python-version == '3.x'`, and `3.x` is the
leg carrying `experimental: true`, which resolves to
`continue-on-error: true`. Coverage is therefore measured against a
floating Python, and any failure on that leg, whether an upstream
incompatibility or a coveralls outage, leaves CI green while coverage
quietly stops reporting.

## Scope

- Drop the duplicate `poetry run pytest` from the coveralls step.
- Upload coverage from a leg whose failure is visible, on a pinned
Python version.
- Decide whether an upload failure should fail the job, and make that
explicit rather than inherited from `continue-on-error`.

## Acceptance criteria

- [ ] The suite runs once per matrix leg
- [ ] Coverage uploads from a pinned Python version rather than `3.x`
- [ ] A coveralls upload failure produces a visible signal rather than a
green run

## Additional context

Found in the same audit as #557.