package-tests.yml should invoke Composer scripts, and upload coverage to Codecov

MODULES.md §4 r20 says test bootstrap is shared once while each repository owns its own Composer aliases and CI workflows. The only reading under which the alias clause means anything is that the reusable workflow invokes a package's Composer scripts rather than binaries directly — otherwise the aliases exist and nothing ever calls them.

package-tests.yml currently runs binaries.

Ask

1. Invoke Composer scripts. composer test, composer analyse, composer lint — whatever the package declares — so a package that needs different flags expresses that in its own composer.json rather than needing a workflow change.
2. Upload coverage to Codecov. Coverage is generated and then discarded; REPOSITORIES.md §6.3 builds badge URLs that have nothing behind them.

Context

ecommerce-laravel is planning ~100 module repositories, each shipping the three workflows MODULES.md §24.1 fixes them at, all as 12–22 line thin callers into this repository. Every one of them inherits whatever this workflow does, which is why it is worth getting right before the fan-out rather than after.

Found while planning module CI for ecommerce-laravel.

Start by reading package-tests.yml and the workflow conventions described in MODULES.md §4 and §24.1. Check how each package declares its Composer scripts in composer.json, then update the workflow so those scripts are invoked and the generated coverage is uploaded to Codecov; done means package-specific aliases control testing, analysis, and linting while coverage reaches Codecov.