ci: make Codecov publication a blocking gate after reliability soak

The Rust quality sprint made coverage ownership and thresholds enforceable locally, while Codecov publication remains intentionally best-effort until the upload path demonstrates reliability.

Acceptance criteria:

- Observe ten consecutive complete main-branch runs that successfully upload Rust unit, Linux, integration, Python, frontend, release-site, and test-result coverage artifacts.
- Prove the upload path still succeeds for a fork pull request without repository secrets.
- Change Codecov coverage and test-result publication to fail the workflow on upload errors and make the resulting status required.
- Add a repository contract test that rejects restoring non-blocking Codecov publication after the switch.

Start by locating the CI workflow steps that publish Rust unit, Linux, integration, Python, frontend, release-site, and test-result coverage, along with any existing repository contract tests. Verify ten consecutive complete main-branch uploads and a fork pull request without repository secrets. Done means upload failures block the workflow, the status is required, and a contract test prevents reverting to non-blocking publication.

Written by the indexing model from the issue text.