Codecov coverage stuck on carryforward for all PRs after deferring the upload to workflow_run

### Problem

After the Codecov upload was moved out of the `build` (Required Checks) run into a deferred `workflow_run` workflow (#6730, then #6824), coverage stopped updating on PRs. Every PR now shows its **own** flag as `Carriedforward` instead of a fresh delta, so a PR's actual coverage change is never reflected.

### Evidence

| PR | upload path | `frontend` flag in the Codecov comment |
|----|----|----|
| #6651 (pre-deferral) | inline | `78.34% (+0.04%)` ⬆️ — **fresh** |
| #6818 (post-deferral) | deferred | `80.18% (-1.54%)` — **Carriedforward** |
| #6829 (post-deferral) | deferred | `81.72%` — **Carriedforward** |

The deferred upload itself *succeeds*: for #6829 the `Codecov Upload` run uploaded `upload-coverage --pr 6829 --sha 731e3af7… --flag frontend` → "Found 1 coverage files" → "Upload queued for processing complete", and the PR comment was even re-rendered afterward — yet the flag stays `Carriedforward`. So Codecov receives the upload but never adopts it as the head commit's fresh session.

### Root cause

Deferring the upload into a separate `workflow_run` (after Required Checks) means Codecov builds each PR's head report and posts/updates the comment via **carryforward** before/independently of the late-arriving upload; the upload landing in a separate, later run is not reflected as the fresh flag source. When uploads happened **inline during** Required Checks (the previous behavior), the flag was present when Codecov built the report → shown fresh.

### Resolution

Revert the deferred approach (#6730 + #6824) and restore the inline `codecov/codecov-action` uploads. The original motivation — fork PRs occasionally missing the Codecov comment under burst due to tokenless rate-limiting (#6685) — is the lesser problem and should be revisited separately, without moving uploads off the CI run.