ci: report coverage to Codecov, add a badge

[patramsey]

Adds the coverage badge. The configuration matters more than the badge here, because the naive version of this is actively misleading.

The number is wrong by 2.7x unless the generated client is excluded

internal/api/gen/zz_generated.go is 7,488 of the repository's 11,848 statements — 63% of the codebase — generated by oapi-codegen from the vendored spec. It has 0% coverage and always will; covering it means writing tests for somebody else's code generator.

	Coverage
Including the generated client	23.4%
Excluding it (codecov.yml ignore)	63.6%

So the badge would have understated the tested-ness of the hand-written code by a factor of 2.7. codecov.yml ignores that one file.

Per-package, the hand-written code runs 58–83%:

Package		Package
cmd/apicmd	83.3%	cmd/config	72.5%
internal/config	82.6%	cmd/dns	71.0%
cmd/order	79.0%	cmd/contact	70.8%
cmd/dnssec	77.2%	cmd/url	69.6%
cmd/domain	74.7%	cmd/cmdutil	66.5%
cmd/vanity	74.2%	cmd/email	65.6%
internal/api	73.9%	cmd/transfer	58.4%

The visible gaps are internal/output (30.1%) and cmd (38.1%) — worth a look later, not in this PR.

Three deliberate choices

• The profile rides along on the existing test run, rather than getting its own step. A second full go test -race would roughly double that job for a number the first run already computed.
• Both project and patch statuses are informational. A coverage gate that fails a PR invites the two worst responses: padding tests to clear a threshold, or merging past a red check until red checks stop meaning anything.
• The upload is continue-on-error with fail_ci_if_error: false. Coverage reporting isn't a correctness signal — Codecov being down or rate-limiting must not turn a PR red when the tests passed.

The action is SHA-pinned like the other four, to fb8b358. Note that's the commit v7.0.0's annotated tag dereferences to — not the tag object's own SHA, which is what the naive git/ref/tags lookup returns. Dependabot's github-actions group will bump it.

⚠️ Needs a repo secret before the badge works

CODECOV_TOKEN does not exist on this repo yet. You'll need to:

1. Sign in at codecov.io with GitHub and add patramsey/namecom-cli
2. Copy the upload token
3. gh secret set CODECOV_TOKEN -R patramsey/namecom-cli

Until then the upload step no-ops (it's continue-on-error), CI stays green, and the README badge renders as "unknown". Nothing else in CI is affected. Happy to hold this PR unmerged until the token's in place if you'd rather not have an unknown badge on main in the meantime.

Test plan

• Both YAML files parse
• go test -race -count=1 -coverprofile=coverage.out ./... — the exact CI command — writes an 8,361-line profile locally
• Applying codecov.yml's ignore rule to that profile yields 63.6%, confirming what the badge will read
• Action SHA verified against the v7.0.0 release via the GitHub API