fix(ci): use a colon-prefixed branch for fork tokenless Codecov uploads

[JSONbored]

Summary

• Fixes a live CI failure hit on a real fork PR rebase: the fork-tokenless Codecov upload steps (added in fix(ci): close the fork-PR codecov/patch silent-pass gap #2273) started failing with Upload queued for processing failed: {"message":"Token required because branch is protected"}.
• Root cause: override_branch was set to the bare fork branch name (e.g. feat/mcp-block-explorer-feed-filters). Per Codecov's own docs, only a branch string with a colon-separated prefix (e.g. forkname:branch) is recognized as "unprotected" and eligible for a tokenless upload — a bare name looks like it could be a real (possibly protected) branch on the base repo and gets rejected, even with zero token configuration anywhere. Confirmed directly in codecov-cli's source (services/commit/__init__.py): if branch and ":" in branch: ... elif token is None: # protected, warns/rejects. codecov-cli's own auto-detection never adds this prefix either (checked helpers/ci_adapters/github_actions.py — _get_branch() returns the bare GITHUB_HEAD_REF), so it has to be supplied explicitly by the caller.
• Fix: prefix override_branch with the fork owner (${{ github.event.pull_request.head.repo.owner.login }}:${{ github.event.pull_request.head.ref }}) on both fork-tokenless upload steps. override_commit/override_pr are untouched — the protected-branch check only inspects the branch string.

Why

Follow-up to #2273. The prior fix correctly attributed fork-tokenless uploads to the real PR head sha (closing a misattribution gap flagged by the gate's own AI review), but didn't account for Codecov's separate "is this branch protected" check, which is evaluated purely on the branch string format. This is a live, user-reported failure on an actual contributor PR rebase, not a theoretical concern.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused (CI workflow only).
• This follows CONTRIBUTING.md.
• No issue linked — direct follow-up fix for a live CI failure discovered and diagnosed in this session.

Validation

• git diff --check
• npm run actionlint
• npm run test:coverage locally (no src/** lines changed; test/unit/codecov-policy.test.ts updated with assertions for the colon-prefixed branch format)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• test/unit/codecov-policy.test.ts extended to assert the fork-tokenless steps' override_branch contains a colon and matches the owner:branch format

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise.
• Auth/CORS/session negative-path tests — N/A, no such change.
• API/OpenAPI/MCP behavior — N/A.
• UI changes — N/A, CI-only change.
• Public docs/changelogs — N/A.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.71%. Comparing base (ec131cf) to head (dd70688).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2363   +/-   ##
=======================================
  Coverage   95.71%   95.71%           
=======================================
  Files         222      222           
  Lines       24655    24655           
  Branches     8946     8946           
=======================================
  Hits        23599    23599           
  Misses        433      433           
  Partials      623      623           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.