[BUG] Coverage fails to upload from fork

Describe the bug
A clear and concise description of what the bug is.

On pull requests from forks, coverage fails to upload with the error message: Token required because branch is protected

orb version: codecov/codecov@5.3.0

with arguments: https://github.com/ESMValGroup/ESMValCore/blob/62314887e3b722b1d20d42f9b7a39203a7706ceb/.circleci/config.yml#L146-L148

To Reproduce
Steps to reproduce the behavior:

1. Go to https://app.circleci.com/pipelines/github/ESMValGroup/ESMValCore/13423/workflows/9358d8bc-e8b6-4b0b-884b-d4da6aabaae6/jobs/55456
2. Click on 'Upload to Codecov'
3. Scroll down to the bottom
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

I would expect the orb to upload coverage when it comes from a fork.

Regression
State whether this is a regression and when the last successful instance occurred

Screenshots
If applicable, add screenshots to help explain your problem.

    _____          _
    / ____|        | |
   | |     ___   __| | ___  ___ _____   __
   | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
   | |___| (_) | (_| |  __/ (_| (_) \ V /
    \_____\___/ \__,_|\___|\___\___/ \_/
                            Wrapper-0.2.2
                                  
==> Detected linux
 -> Downloading https://cli.codecov.io/latest/linux/codecov
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10.6M  100 10.6M    0     0  69.8M      0 --:--:-- --:--:-- --:--:-- 69.7M
==> Finishing downloading linux:latest
      Version: v11.0.3
 
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig
 
gpg: Signature made Thu May 29 21:23:31 2025 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
codecov: OK
==> CLI integrity verified

 -> Token length: 0
==> Running upload-coverage
      ./codecov  upload-coverage --disable-search --file test-reports/coverage.xml --report-type coverage
info - 2025-07-23 11:57:30,992 -- ci service found: circleci
warning - 2025-07-23 11:57:31,050 -- xcrun is not installed or can't be found.
warning - 2025-07-23 11:57:31,051 -- gcov is not installed or can't be found.
warning - 2025-07-23 11:57:31,051 -- coverage.py is not installed or can't be found.
info - 2025-07-23 11:57:31,105 -- Found 1 coverage files to report
info - 2025-07-23 11:57:31,105 -- > /root/project/test-reports/coverage.xml
info - 2025-07-23 11:57:31,376 -- Process Upload complete
error - 2025-07-23 11:57:31,376 -- Upload failed: {"message":"Token required because branch is protected"}

Product Area
If applicable, the product with the given bug (e.g. coverage, test analytics, browser extension, bundle analysis)

Versions

• OS: [e.g. linux, ubuntu@v24, macos arm64, windows]
• Git Host: [e.g. GitHub, GitLab, Bitbucket]
• CI/CD: [e.g. GitHub Actions, CircleCI]
• Uploader: [e.g. codecov-action@v5.3.1, codecov-circleci-orb@v5.2.0, codecov-cli@v10.0.1, uploader@v0.8.0]

Commit and CI link
Provide the commit SHA and CI link. If applicable, provide the entire Codecov output from CI.

Additional context
Add any other context about the problem here.

Start with .circleci/config.yml at lines 146-148 and reproduce the fork pull request in the linked CircleCI job using codecov/codecov@5.3.0. Compare the orb's handling of fork uploads and protected branches; done means coverage uploads successfully without the “Token required because branch is protected” error.