ci: report coverage in the job summary and to Codecov

[joseph3114]

Coverage was already being collected — --collect:"XPlat Code Coverage" with coverlet.collector referenced — but the Cobertura file went into a 124 KB artifact zip and nowhere else. Collected but invisible.

Two reporting surfaces, because they answer different questions.

1. Job summary — visible on every run, no third party

ReportGenerator merges the net8.0 and net10.0 Cobertura files (so the figure is the union of both runs, not whichever finished last) and writes a markdown table straight into $GITHUB_STEP_SUMMARY. It appears on the run page itself. No account, no token, nothing to sign up for.

2. Codecov — trend and diff coverage

The thing a job summary can't do: comment on each PR with coverage of the lines that PR changed. A whole-repository percentage is a number people stop seeing after a week; "you added 40 lines, 12 aren't covered" changes review behaviour.

Badge added to the README. codecov.io is on nuget.org's image allow-list, so it renders on the package page too — the same check that ruled out Scorecard's native badge URL earlier.

⚠️ Needs a CODECOV_TOKEN repository secret before the upload works. Get it from codecov.io after linking the repo. Until then the step no-ops: fail_ci_if_error: false means a failed upload never fails the build — it reports on the tests, it isn't one of them.

codecov.yml — deliberately advisory

Both statuses are informational: true, so Codecov can never fail a check.

Current coverage is 25.2% of lines, 43.9% of branches, and that number misleads in both directions. The code with real logic — the adapter, paging arithmetic, the JSON converters, filter building, retry classification — is well covered; that's where the 98 tests point and where the actual bugs were. The uncovered majority is DTOs with no behaviour and ~14 providers of near-identical passthrough methods. A test over an auto-property asserts that C# assigns fields.

A red X on every PR for missing a threshold nobody chose is noise, and noise gets muted. patch targets 80% as a visible signal on new code without blocking anything.

tests/, samples/ and tools/ are excluded from the denominator — none of it is library code a consumer runs.

Safety

All three new actions SHA-pinned, consistent with #33. Every workflow re-validated as parseable, and the Build & test job name is unchanged — it's named in the branch ruleset, so a rename would make master unmergeable.