ci: upload coverage over OIDC instead of a token #patch

[nmichlo]

Coverage now uploads with OIDC, so this repo needs no CODECOV_TOKEN.

-   secrets:
-     CODECOV_TOKEN: \${{ secrets.CODECOV_TOKEN }}
+   permissions:
+     contents: read
+     id-token: write

A reusable workflow cannot hold more permission than its caller, so the id-token grant has to live here.

Pairs with nmichlo/.github#4 -- merge this one first, since that PR deletes the CODECOV_TOKEN declaration and passing an undeclared secret is a hard error.

Codecov failures never fail the build (fail_ci_if_error: false).

🤖 Generated with Claude Code