Security: Codecov upload token committed in plaintext in .github/workflows/coverage.yml (please rotate + move to a secret)

### What happened `.github/workflows/coverage.yml` hardcodes a **Codecov upload token in plaintext** and passes it to a third-party action: - **line 30** — `token: <redacted>` (a Codecov upload token, committed in the clear) - line 26 — `uses: codecov/codecov-action@v3` - line 16 — `uses: actions/checkout@master` (I've redacted the token value here on purpose and have not tested it against any service — I'm only reporting that a credential is committed.) ### Why it matters A credential committed to a public repository is readable by anyone and should be treated as compromised. Codecov *upload* tokens are limited in scope (they permit uploading coverage reports, not code push/read), so the blast radius is bounded — but the standard, low-risk fix is to **rotate the token and move it to a repository secret**. Every other credential in this repo's workflows already uses `${{ secrets.* }}` (e.g. `DOCKERHUB_TOKEN`, `NEXUS_PW`), so this one line is the exception. There's also a small supply-chain angle: the token is handed to `codecov/codecov-action@v3` (a mutable major tag) in a job that also uses `actions/checkout@master` (a mutable branch), so pinning those to full commit SHAs would harden the path the credential flows through. ### Suggested fix 1. **Rotate** the current Codecov token (regenerate it in Codecov). 2. Store it as a repository secret and reference it: `token: ${{ secrets.CODECOV_TOKEN }}`. 3. (Optional) Pin `codecov/codecov-action` and `actions/checkout` to full commit SHAs. Happy to send a PR for the workflow change once the token is rotated (I understand PRs need an ICLA on file). I used AI assistance to spot this; I verified the file and line numbers myself and did not exfiltrate or use the credential.