Upgrade CI action runtimes and remove broken coverage upload

[JovaniPink]

Summary

• upgrade actions/checkout and actions/setup-python to their v7 Node-runtime releases across pull-request, release, and release-preflight workflows
• remove the nonfunctional Codecov upload while retaining the repository-enforced 90% coverage gate
• document and regression-test the resulting CI contract

Why

The previous workflow appeared green while Codecov logged Token required - not valid tokenless upload; the action's default behavior swallowed the error. A hosted trial of OIDC on commit b5f4023 successfully issued an identity token and found coverage.xml, but Codecov returned Repository not found, confirming that the external integration is not configured for this repository.

The test suite already enforces the 90% coverage floor. Removing the broken upload makes CI honest and removes an unnecessary external dependency instead of adding a long-lived secret or preserving a permanently failing step.

Scope and non-scope

This changes CI action runtimes and removes a broken coverage publishing step. It does not change the xstate runtime API, SCXML behavior, package version, release trigger, or PyPI credentials. No release or publication was triggered.

Local validation

• primary test suite: 417 passed
• configured SCXML suite: 54 passed
• workflow contract tests: 2 passed after the final narrowing
• mypy: 22 source files clean
• Ruff format and lint: clean
• poetry check --lock: clean
• sdist and wheel build: passed
• installed-wheel smoke validation: passed
• git diff --check: clean

Hosted acceptance gate

Merge only if all four checks on exact head c3de600 are green and GitHub reports no deprecated Node runtime annotation.

Risk and rollback

The repository will no longer publish coverage to Codecov. The enforced 90% pull-request threshold remains in the primary test command, so this does not weaken acceptance. Rollback is a revert of these two commits; no application or package state is mutated.

Review focus

• consistent v7 checkout and Python setup majors across all Python workflows
• preservation of the enforced coverage threshold without an unconfigured external service
• regression coverage for the workflow contract