ci: pass CODECOV_TOKEN via secrets inherit for PR builds

Switch conda-python-tests in pr.yaml to secrets: inherit so CODECOV_TOKEN
reaches the shared-workflow codecov step. S3/AWS secrets are not needed
for PR builds (nightly_report_helper skips S3 when RAPIDS_BUILD_TYPE!=nightly).

Re-add run_codecov: false to test.yaml conda-python-tests since S3 explicit
secrets are required there for nightly report aggregation, leaving no slot
for CODECOV_TOKEN until rapidsai/shared-workflows#<TBD> lands.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>

Author: ramakrishnap-nv

.github/workflows/pr.yaml

@@ -416,13 +416,7 @@ jobs:
     with:
       build_type: pull-request
       script: ci/test_python.sh
-    secrets:
-      script-env-secret-1-key: CUOPT_S3_URI
-      script-env-secret-1-value: ${{ secrets.CUOPT_S3_URI }}
-      script-env-secret-2-key: CUOPT_AWS_ACCESS_KEY_ID
-      script-env-secret-2-value: ${{ secrets.CUOPT_AWS_ACCESS_KEY_ID }}
-      script-env-secret-3-key: CUOPT_AWS_SECRET_ACCESS_KEY
-      script-env-secret-3-value: ${{ secrets.CUOPT_AWS_SECRET_ACCESS_KEY }}
+    secrets: inherit # zizmor: ignore[secrets-inherit]
   docs-build:
     needs: [conda-python-build, changed-files]
     permissions:

.github/workflows/test.yaml

@@ -59,6 +59,7 @@ jobs:
       pull-requests: read
     uses: rapidsai/shared-workflows/.github/workflows/conda-python-tests.yaml@main
     with:
+      run_codecov: false
       build_type: ${{ inputs.build_type }}
       branch: ${{ inputs.branch }}
       date: ${{ inputs.date }}