fix(ci): replace inherited Codecov literal with OIDC

[Eli Pinkerton (wallstop)]

Summary

• remove the inherited credential-shaped Codecov literal without adding a replacement secret
• replace the legacy uploader with pinned Codecov v7 and isolated OIDC for trusted main/same-repository runs
• keep fork and Dependabot uploads tokenless through an unprotected PR branch identity
• reject future credential-shaped workflow env literals recursively with sanitized diagnostics

Security boundary

Coverage generation runs with contents: read only. Coverage crosses a one-day artifact boundary into exact no-checkout upload jobs. Only the trusted upload job can request an OIDC token; fork and Dependabot jobs cannot.

The inherited value matches upstream and is not an Ambiguous-Interactive repository or organization secret, per the repository owner. This PR does not reproduce it.

Validation

• full Vitest suite: 365 passed, 2 skipped
• workflow policy: 6 passed
• resource cleanup contract: RC001-RC019 passed
• lint/typecheck/scoped format/actionlint passed
• seven adversarial review/remediation rounds; final result: zero findings
• no licensed Unity jobs are triggered by this change

References Ambiguous-Interactive/ambiguous-organization-build-lock#45

---

Note

Medium Risk
Changes CI auth boundaries and coverage upload paths; mistakes could break uploads or widen token exposure, but scope is limited to GitHub Actions and adds contract tests.

Overview
Removes the hardcoded Codecov token from integrity-check and stops using the curl-based uploader in the test job. Coverage is uploaded only after it crosses a short-lived artifact from a contents: read test job into separate, no-checkout upload jobs.

Trusted main and same-repo PR runs use pinned Codecov v7 with OIDC (id-token: write only on that job). Fork and Dependabot PRs upload tokenless with override_branch and no OIDC.

Adds workflow-credential-policy (scanner + tests) and wires yarn test:workflow-policy into CI. verify-resource-cleanup-contract gains RC018 (recursive ban on credential-shaped env literals with safe diagnostics) and RC019 (locks the artifact/OIDC/tokenless job split and ordering).

^{Reviewed by Cursor Bugbot for commit e6b2df8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Eli Pinkerton (wallstop)]

Exact head e3f2b4bf43e6f223a6426ae1f4810da98bb54666 is ready for review.

Cursor (@cursor) review

bugbot run

copilot-pull-request-reviewer review

@copilot review

Please report every substantive correctness, security, CI, and maintainability issue; report exact zero if none.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Eli Pinkerton (wallstop)]

Addressed the coverage-order finding at exact head 9de63a0371bb52734ea677db56be640fe1fab2f2. Coverage/artifact failures now skip uploads; a later dist failure still uploads the preserved report. RC019 enforces producer ordering and default failure gating.

Cursor (@cursor) review

bugbot run

copilot-pull-request-reviewer review

@copilot review

Please re-review the complete exact-head diff and report every issue; report exact zero if none.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9de63a0. Configure here.}

[Eli Pinkerton (wallstop)]

All exact-head CI and the fork canary are now green. Both review threads are resolved: the first was fixed in 9de63a0371bb52734ea677db56be640fe1fab2f2; the second was refuted by successful same-repo and fork artifact transfers under the current least-privilege scopes.

Cursor (@cursor) review

bugbot run

Please perform a final exact-head review and report zero if no actionable issue remains.

[Eli Pinkerton (wallstop)]

Exact head e6b2df8e7286d1044fcdbae94cf3a8ce2c2b23bc documents the live-proven artifact permission boundary. Both prior threads are resolved.

Cursor (@cursor) review

bugbot run

copilot-pull-request-reviewer review

@copilot review

Please review the entire exact-head diff and report every issue; report exact zero if none.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.