[BUG] Tokenless upload result inconsistent between two repository.

Describe the bug
When create fork PR to sbombastic's workflow will uploads to the codecov fail, but it works on the kubewarden-controller's workflow
[context]
Common

• Both workflow use the latest v5.4.3 action
• Both codecov.io require the upload global token

Diff (but both of them are fork PR, this diff should not matter)

• secret level
  • sbombastic use repo-level secret to upload
  • kubewarden use the org-level secret to upload

To Reproduce
Steps to reproduce the behavior:

1. Go to sbombastic
2. fork the repo
3. create a PR to upstream repo
4. See error on workflow CI

Expected behavior
Both of the repo should either works on uploading or failing.

Regression

• sbombastic last success, https://github.com/rancher-sandbox/sbombastic/pull/192, May 5.
• kubewarden always works

Screenshots

Product Area
If applicable, the product with the given bug (e.g. coverage, test analytics, browser extension, bundle analysis)

Versions

• OS: ubuntu-latest
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3

Commit and CI link

• Fail one: https://github.com/rancher-sandbox/sbombastic/actions/runs/15831116596/job/44623743699#step:5:381
• Successful one: https://github.com/kubewarden/kubewarden-controller/actions/runs/15619551212/job/44000672312#step:5:393

Additional context
Add any other context about the problem here.

Start by comparing the linked sbombastic and kubewarden-controller workflow runs, especially their secret scopes and codecov-action@v5.4.3 upload steps. Reproduce the fork pull request failure and identify why the repository-level secret behaves differently; done means both workflows have consistent tokenless upload behavior or a documented, reproducible distinction.