ci: migrate Codecov coverage upload from the deprecated legacy uploader to the Codecov CLI

## Background

`scripts/test-infra/verify.sh` uploads coverage using the **legacy Codecov bash uploader** (`https://uploader.codecov.io/latest/linux/codecov`) and previously imported its PGP key from `https://keybase.io/codecovsecurity/pgp_keys.asc`.

Both are problematic:
- The Keybase PGP key URL now returns a 32-byte `SELF-SIGNED PUBLIC KEY NOT FOUND` stub (Keybase shutdown), which broke `verify-master` for every PR (fixed as a stopgap by making the upload non-fatal — see the linked PR).
- The legacy uploader itself is **deprecated** by Codecov in favor of the [Codecov CLI](https://docs.codecov.com/docs/codecov-uploader). It will eventually stop working entirely.

## Proposal

Migrate the coverage upload in `verify.sh` to the supported **Codecov CLI** (`cli.codecov.io`), including its integrity-verification flow, while keeping the upload best-effort (non-gating). Validate it works in the Prow `verify-master` job (this is not a GitHub Actions context, so the `codecov-action` is not applicable).

## Why separate

The immediate breakage was fixed minimally (make coverage upload non-fatal) to unblock merges. This modernization is a larger change with more review surface and is tracked here per one-concern-per-PR.

Start with scripts/test-infra/verify.sh and the Codecov CLI documentation, then inspect how the Prow verify-master job invokes the script. Replace the legacy uploader with the CLI and its integrity-verification flow while preserving best-effort, non-gating behavior; done means coverage upload works in verify-master without the deprecated Keybase flow.

Written by the indexing model from the issue text.