ci: bump codecov-action to v7.0.0 to fix GPG verification

The Coverage Report job has failed on every master run since at least
2026-07-21, always at 'Upload coverage to Codecov':

  gpg: no valid OpenPGP data found.
  gpg: Total number processed: 0
  gpg: Can't check signature: No public key
  ==> Could not verify signature. Please contact Codecov if problem continues

The pinned SHA is v5.5.2, whose wrapper fetches Codecov's signing key from
keybase.io/codecovsecurity/pgp_keys.asc. Codecov deleted that keybase account
and moved to codecovsecops (see the v7.0.0 release notes), so the import
returns nothing, zero keys are imported, and the signature check that follows
can never succeed. Permanent, not transient.

v7.0.0 fetches from keybase.io/codecovsecops/pgp_keys.asc. It is a composite
action like v5, and the three inputs used here (token, fail_ci_if_error,
files) are unchanged, so this is a drop-in swap.

Side effect of the failure: 'Trigger Beekeeper' declares
needs: [test, lint, coverage], so it has been skipped on master for over a
month along with the coverage job.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: darkobas2

.github/workflows/go.yml

@@ -102,7 +102,7 @@ jobs:
     - name: Test with code coverage
       run: make cover=1 test-ci
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         fail_ci_if_error: true