ci: authenticate Codecov uploads with GitHub OIDC

[hadrien]

Problem

• Coverage uploads depend on the long-lived CODECOV_TOKEN repository secret.

Solution

• Authenticate Codecov uploads with GitHub OIDC.
• Grant identity-token issuance only to compatibility jobs.
• Keep coverage uploads nonblocking.

Next

• Remove CODECOV_TOKEN after merging and verifying uploads.

fs-9qd

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (835bd17) to head (7c7896b).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #178   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines          133       133           
  Branches         7         7           
=========================================
  Hits           133       133           

Flag	Coverage Δ
fastapi-post121	97.74% <ø> (ø)
fastapi-pre121	100.00% <ø> (ø)
python-3.12	100.00% <ø> (ø)
python-3.13	100.00% <ø> (ø)
python-3.14	100.00% <ø> (ø)
sqlmodel	96.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.