ci: gate Code Coverage on github.repository instead of token presence

The previous commit (51bb5c8) gated the Code Coverage job on
`secrets.CODECOV_TOKEN != ''`. That breaks if upstream relies on
tokenless / OIDC upload — they wouldn't have the secret set, and the
job would skip on `vitessio/vitess` too.

Switch to the same pattern we already use for runner selection:
`if: github.repository == 'vitessio/vitess'`. Coverage runs on upstream
unconditionally, and forks skip without burning ~16 minutes of unit
tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Arthur Schreiber <arthur@planetscale.com>

Author: arthurschreiber

.github/workflows/codecov.yml

@@ -16,11 +16,11 @@ permissions: read-all
 jobs:
   test:
     name: Code Coverage
-    # Skip the whole job when no CODECOV_TOKEN is available — without one the
-    # final upload step fails ("Token required - not valid tokenless upload"),
-    # so running the test suite just to throw the report away is wasted work.
-    # Forks that want coverage can opt in by configuring CODECOV_TOKEN.
-    if: ${{ secrets.CODECOV_TOKEN != '' }}
+    # Skip on forks: the upload step requires CODECOV_TOKEN, which isn't
+    # configured on forks, and Codecov no longer allows tokenless uploads
+    # ("Token required - not valid tokenless upload"). Without this gate
+    # we'd burn ~16 minutes on the test suite just to red-fail the upload.
+    if: ${{ github.repository == 'vitessio/vitess' }}
     runs-on: ${{ github.repository == 'vitessio/vitess' && 'gh-hosted-runners-16cores-1-24.04' || 'ubuntu-24.04' }}
 
     steps: