chore(ci): remove dead Codecov upload steps + lock pins (#85)

Removed CI references to apps that are no longer installed on this
account/org.

### Why this is a fix, not a tidy-up
- Codecov was uninstalled as a GitHub App, but its action steps remain
in workflows.
- The estate Actions allowlist already pruned `codecov/codecov-action@*`
(`standards/config/settings/actions-allowlist.json` ->
`pruned_from_live_2026_09_02`), so a workflow still calling it fails at
job start instead of quietly no-op-ing.
- Snyk / Codacy / Mergify / ImgBot / CodeFactor are on the estate
never-re-add list (`standards` spec §9, rulings R1/R4/R5).

### Changes
- `.github/workflows/ci.yml` — applied

### Notes
- `actions.lock` entries for the removed actions are deleted in this
same commit (the same-PR regen rule in the CI/CD regularisation spec
§6.4), so `actions-lock-verify` sees no drift.
- Removals are line-exact; no other line was reformatted and no comment
was re-wrapped.
- Historical records (milestone logs, CHANGELOG, audit docs, specs) that
*describe* the removal were deliberately left untouched.
- The `gitar-approved` label is intentionally frozen per
`docs/LABELS.adoc` — it is not an active Gitar install, so it stays.

Author: hyperpolymath

.github/workflows/ci.yml

@@ -135,13 +135,6 @@ jobs:
       - name: Generate coverage report
         run: rebar3 cover --verbose
 
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
-        with:
-          files: _build/test/cover/cobertura.xml
-          fail_ci_if_error: false
-          verbose: true
-
   ###########################################################################
   # Static Analysis
   ###########################################################################