ci: drop the unused CODECOV_TOKEN reference

[patramsey]

Codecov accepts tokenless uploads from public repositories, so the secret reference was never needed. Verified against a known-working public-repo configuration, which uploads and reports with no token input at all:

- uses: codecov/codecov-action@<sha>
  with:
    files: coverage.out
    fail_ci_if_error: false

This is a correction, not a fix

Worth being clear so nobody expects the badge to light up from this PR: an empty token: input and an absent one are identical to the action. It checks [ -n "$INPUT_TOKEN" ] and skips when empty — which is precisely what the failing run did (-> Token length: 0). Removing the line changes no behavior. It just stops the workflow pointing at a secret that doesn't exist and shouldn't need to.

What actually blocked the upload

This repository isn't activated on Codecov's side. Their API for it:

{ "active": false, "activated": false, "totals": null }

Codecov's error for that case is {"message":"Token required - not valid tokenless upload"}, which reads like an auth failure and is what sent me looking for a missing credential. The token was a red herring — activation is the discriminator, and a public repository that is activated uploads fine with no token at all.

Activation is a console-side action — nothing in this repo can do it. Once patramsey/namecom-cli is activated at codecov.io, uploads should start landing with this config as-is, and the README badge flips from unknown to ~64%.

Residual uncertainty

The configuration I verified tokenless behavior against runs codecov-action v5.5.5; this repo runs v7.0.0. I've confirmed v5 uploads tokenless on a push to a default branch, but not v7 — its own logic only sets the tokenless variable when CC_FORK == 'true', which may be an internal detail or may matter server-side. If uploads still don't land after activation, that version difference is the first thing to check.

Test plan

• ci.yml parses as valid YAML
• Only the token: line removed — no other workflow change
• Behavior verified identical by reading the action's own token-handling shell from the failing run's log