Security: Codecov upload token committed in plaintext in .github/workflows/coverage.yml (please rotate + move to a secret)

### What happened

`.github/workflows/coverage.yml` hardcodes a **Codecov upload token in plaintext** and passes it to a third-party action:

- **line 30** — `token: ` (a Codecov upload token, committed in the clear)
- line 26 — `uses: codecov/codecov-action@v3`
- line 16 — `uses: actions/checkout@master`

(I've redacted the token value here on purpose and have not tested it against any service — I'm only reporting that a credential is committed.)

### Why it matters

A credential committed to a public repository is readable by anyone and should be treated as compromised. Codecov *upload* tokens are limited in scope (they permit uploading coverage reports, not code push/read), so the blast radius is bounded — but the standard, low-risk fix is to **rotate the token and move it to a repository secret**. Every other credential in this repo's workflows already uses `${{ secrets.* }}` (e.g. `DOCKERHUB_TOKEN`, `NEXUS_PW`), so this one line is the exception.

There's also a small supply-chain angle: the token is handed to `codecov/codecov-action@v3` (a mutable major tag) in a job that also uses `actions/checkout@master` (a mutable branch), so pinning those to full commit SHAs would harden the path the credential flows through.

### Suggested fix

1. **Rotate** the current Codecov token (regenerate it in Codecov).
2. Store it as a repository secret and reference it: `token: ${{ secrets.CODECOV_TOKEN }}`.
3. (Optional) Pin `codecov/codecov-action` and `actions/checkout` to full commit SHAs.

Happy to send a PR for the workflow change once the token is rotated (I understand PRs need an ICLA on file). I used AI assistance to spot this; I verified the file and line numbers myself and did not exfiltrate or use the credential.

Start with .github/workflows/coverage.yml, especially the Codecov step around lines 26 and 30, and compare its credential handling with the other workflow secrets. Confirm with a maintainer that the exposed Codecov token has been rotated, then update the workflow to reference the repository secret. Done means no plaintext token remains and the coverage workflow still receives its upload credential.

Written by the indexing model from the issue text.