Authenticate coverage uploads with GitHub OIDC

[Kyle-Ye]

Codecov rejects unauthenticated coverage uploads from protected branches, but the CI jobs still pass because upload errors are non-fatal.

Use GitHub OIDC to authenticate coverage uploads on macOS and Ubuntu. Limit the new permission to those jobs and fail CI when a coverage upload fails.

Validation:

• actionlint passes for both workflows, and git diff --check passes.
• All six GitHub Actions jobs pass on e34d96a.
• The macOS, Ubuntu 22.04, and Ubuntu 24.04 logs confirm successful OIDC authentication and coverage uploads with HTTP 200.
• codecov/patch passes. codecov/project reports 96.32% against the old 96.58% baseline at d81fffe, which is four commits behind main. This PR changes only the two workflows; the current main branch needs a fresh coverage report.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.32%. Comparing base (d81fffe) to head (e34d96a).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #27      +/-   ##
==========================================
- Coverage   96.58%   96.32%   -0.26%     
==========================================
  Files         107      108       +1     
  Lines        8311     8080     -231     
==========================================
- Hits         8027     7783     -244     
- Misses        284      297      +13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.