chore(ci): remove dead Codecov upload steps + lock pins (#388)

Removed CI references to apps that are no longer installed on this
account/org.

### Why this is a fix, not a tidy-up
- Codecov was uninstalled as a GitHub App, but its action steps remain
in workflows.
- The estate Actions allowlist already pruned `codecov/codecov-action@*`
(`standards/config/settings/actions-allowlist.json` ->
`pruned_from_live_2026_09_02`), so a workflow still calling it fails at
job start instead of quietly no-op-ing.
- Snyk / Codacy / Mergify / ImgBot / CodeFactor are on the estate
never-re-add list (`standards` spec §9, rulings R1/R4/R5).

### Changes

### Notes
- `actions.lock` entries for the removed actions are deleted in this
same commit (the same-PR regen rule in the CI/CD regularisation spec
§6.4), so `actions-lock-verify` sees no drift.
- Removals are line-exact; no other line was reformatted and no comment
was re-wrapped.
- Historical records (milestone logs, CHANGELOG, audit docs, specs) that
*describe* the removal were deliberately left untouched.
- The `gitar-approved` label is intentionally frozen per
`docs/LABELS.adoc` — it is not an active Gitar install, so it stays.

Author: hyperpolymath