chore(ci): remove dead Codecov upload steps + lock pins (#204)

Removed CI references to apps that are no longer installed on this
account/org.

### Why this is a fix, not a tidy-up
- Codecov was uninstalled as a GitHub App, but its action steps remain
in workflows.
- The estate Actions allowlist already pruned `codecov/codecov-action@*`
(`standards/config/settings/actions-allowlist.json` ->
`pruned_from_live_2026_09_02`), so a workflow still calling it fails at
job start instead of quietly no-op-ing.
- Snyk / Codacy / Mergify / ImgBot / CodeFactor are on the estate
never-re-add list (`standards` spec §9, rulings R1/R4/R5).

### Changes
- `.github/workflows/actions.lock` — applied
- `.github/workflows/coverage.yml` — applied

### Notes
- `actions.lock` entries for the removed actions are deleted in this
same commit (the same-PR regen rule in the CI/CD regularisation spec
§6.4), so `actions-lock-verify` sees no drift.
- Removals are line-exact; no other line was reformatted and no comment
was re-wrapped.
- Historical records (milestone logs, CHANGELOG, audit docs, specs) that
*describe* the removal were deliberately left untouched.
- The `gitar-approved` label is intentionally frozen per
`docs/LABELS.adoc` — it is not an active Gitar install, so it stays.

Author: hyperpolymath

.github/workflows/actions.lock

@@ -28,7 +28,6 @@ workflows:
         - 'github/codeql-action@v4.34.0'
     '.github/workflows/coverage.yml':
         - 'actions/checkout@v5.0.1'
-        - 'codecov/codecov-action@v5.5.2'
         - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/dependency-review.yml':
         - 'actions/checkout@v5.0.1'
@@ -238,19 +237,7 @@ dependencies:
         uses:
             - 'actions/upload-artifact@v4'
 
-    'codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de':
-        ref: '671740ac38dd9b0130fbe1cec585b89eea48d3de'
-        commit: 'sha1-671740ac38dd9b0130fbe1cec585b89eea48d3de'
-        owner_id: 8226205
-        repo_id: 200299178
-
-    'codecov/codecov-action@v5.5.2':
-        ref: 'v5.5.2'
-        commit: 'sha1-671740ac38dd9b0130fbe1cec585b89eea48d3de'
-        owner_id: 8226205
-        repo_id: 200299178
-        uses:
-            - 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+
 
     'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de':
         ref: '02cb101ec7c40f2c49e1d9714d64511d8e1b74de'

.github/workflows/coverage.yml

@@ -36,8 +36,3 @@ jobs:
       - name: Generate coverage
         run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
 
-      - name: Upload to codecov
-        uses: codecov/codecov-action@v5.5.2
-        with:
-          files: lcov.info
-          fail_ci_if_error: false