[Task] Rotate leaked Codecov token and use a secret instead of plaintext

## Description
`token: 2760af6a-3405-4882-9e61-04c5176fecfa` committed literally, not via `${{ secrets.CODECOV_TOKEN }}`. Repo is public. Also `codecov-action@v1` is EOL (current v5).

## Location
```
.github/workflows/ci.yml:138-140
```

## Impact
Anyone can spoof/poison Codecov uploads for the project.

## Suggested fix
Rotate the token in Codecov, store as repo secret, reference via `${{ secrets.CODECOV_TOKEN }}`, bump to `@v5`.

## Related existing issue(s)
None

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Start with .github/workflows/ci.yml lines 138-140 and inspect how the Codecov upload is configured. Rotate the exposed Codecov token, add the replacement as CODECOV_TOKEN, update the action reference to v5, and verify the workflow no longer contains a plaintext token.

Written by the indexing model from the issue text.