feat(ci): Codecov patch coverage (informational) + fix missing lcov reporter (WS5.6) (#7114)

Two changes to the test-coverage job:
- The CI c8 report step never emitted lcov (only text/json summaries), so the
  coverage-report artifact silently skipped coverage/lcov.info
  (if-no-files-found: warn) — the very file the Sonar job consumes. Adding
  --reporter=lcov makes the artifact real for both consumers.
- codecov/codecov-action v5 (SHA-pinned) uploads the lcov after the summary,
  with codecov.yml keeping BOTH statuses informational during calibration
  (D7 decision: informative first, blocking only after ~2 weeks without false
  blocks). Philosophy: strict patch, lenient project — the global floor/ratchet
  already lives in c8 60% + quality-baseline.json; Codecov adds the diff view.
Workflow+config-only change; YAML parse validated; CODECOV_TOKEN secret already
created by the owner.

.github/workflows/ci.yml

@@ -815,6 +815,7 @@ jobs:
             --merge-async \
             --reporter=text-summary \
             --reporter=json-summary \
+            --reporter=lcov \
             --exclude=tests/** \
             --exclude=**/*.test.* \
             --check-coverage \
@@ -836,6 +837,18 @@ jobs:
               > coverage/coverage-report.md
           fi
           cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY"
+      # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov —
+      # informational during calibration (codecov.yml sets informational: true);
+      # promote to blocking only after ~2 weeks without false blocks. The lcov
+      # reporter above also fixes coverage/lcov.info being silently absent
+      # (if-no-files-found: warn) — Sonar consumes the same file.
+      - name: Upload coverage to Codecov (informational)
+        if: always()
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
+        with:
+          files: coverage/lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
       - name: Upload coverage artifacts
         if: always()
         uses: actions/upload-artifact@v7

changelog.d/maintenance/codecov-patch-coverage.md

@@ -0,0 +1 @@
+- **CI**: Codecov patch-coverage on every PR diff (informational during calibration — `codecov.yml` sets nothing blocking; strict-patch/lenient-project philosophy on top of the existing 60% c8 floor + ratchet); the CI coverage job now actually emits `coverage/lcov.info` (the `lcov` reporter was missing, so the artifact silently skipped it — the same file Sonar consumes)

codecov.yml

@@ -0,0 +1,19 @@
+# Codecov — WS5.6/D7 of the v3.8.49 quality/velocity plan.
+# Philosophy: strict patch, lenient project — the project floor/ratchet already
+# lives in quality-baseline.json + the c8 60% gate; Codecov adds the DIFF view
+# ("new lines in this PR are covered"), which the global ratchet cannot see.
+# INFORMATIONAL during calibration: nothing here blocks a PR. Promote by flipping
+# informational to false after ~2 weeks without false blocks (owner decision).
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        target: 70%
+        informational: true
+comment:
+  layout: "condensed_header, diff"
+  behavior: default
+  require_changes: true