[codex] Wire CI coverage upload to Codecov token

[erikhoward]

Summary

This PR updates CI coverage publishing so Go coverage generated in GitHub Actions is uploaded to Codecov using the existing CODECOV_TOKEN secret.

Problem

Coverage generation already existed in CI, but Codecov uploads were not explicitly wired to the token secret. In token-required configurations this can cause uploads to be skipped or fail silently.

Root Cause

The workflow used codecov/codecov-action without passing CODECOV_TOKEN from GitHub Secrets, and upload failures were not configured to fail the job.

Changes

• In .github/workflows/ci.yml:
  • Added job env wiring: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}.
  • Added artifact upload step for coverage.out on Ubuntu (actions/upload-artifact@v4).
  • Updated Codecov upload step to:
    • run only when token is present,
    • pass token: ${{ env.CODECOV_TOKEN }},
    • set fail_ci_if_error: true.

Validation

• Workflow file changes validated locally by review and commit.
• No Go source behavior changed.