Two changes to the test-coverage job:
- The CI c8 report step never emitted lcov (only text/json summaries), so the
coverage-report artifact silently skipped coverage/lcov.info
(if-no-files-found: warn) — the very file the Sonar job consumes. Adding
--reporter=lcov makes the artifact real for both consumers.
- codecov/codecov-action v5 (SHA-pinned) uploads the lcov after the summary,
with codecov.yml keeping BOTH statuses informational during calibration
(D7 decision: informative first, blocking only after ~2 weeks without false
blocks). Philosophy: strict patch, lenient project — the global floor/ratchet
already lives in c8 60% + quality-baseline.json; Codecov adds the diff view.
Workflow+config-only change; YAML parse validated; CODECOV_TOKEN secret already
created by the owner.
