Chore: harden Codecov upload step for fork PRs

[b-j-karl]

Description

The Codecov upload step in CI uses ${{ secrets.CODECOV_TOKEN }}, which is unavailable on pull_request runs from forks (GitHub does not expose repository secrets to fork PRs). For a public repo the upload still works without a token, but it may be unreliable or produce confusing warnings. The step should be hardened so it degrades gracefully.

Scope

• Gate the Codecov upload step with an if condition so it only runs when the token is available (e.g. if: secrets.CODECOV_TOKEN != '' or restrict to push events / non-fork PRs)
• Alternatively, make the step continue-on-error: true so a missing token doesn't fail the workflow
• Verify fork PRs pass CI cleanly after the change

Notes

• Raised during review of docs: fix codecov badge, add uvx note, add large-output guidance #32 (comment 5 by copilot-pull-request-reviewer)
• PR docs: fix codecov badge, add uvx note, add large-output guidance #32 already restored files: coverage.xml alongside the token, so autodiscovery is no longer a concern
• codecov-action v5 accepts an empty token for public repos but recommends providing one for reliability
• Relevant file: .github/workflows/ci.yml, lines 35–40