ci: drop Codecov upload, enforce coverage threshold locally instead

The tokenless OIDC upload failed with "Repository not found" - Codecov has
never synced this repo, so upload requires activating it on codecov.io first.
Rather than depend on that, run Monnify.Tests with coverage collection
separately from the full test pass and fail the build below an 85% line
floor by parsing the cobertura report coverlet already produces - no external
account or token needed. Current baseline is ~95%.

Author: GREENFONTS

.github/workflows/ci.yml

@@ -7,7 +7,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write # required for Codecov's tokenless upload via GitHub OIDC (public repo)
 
 jobs:
   build-and-test:
@@ -41,17 +40,37 @@ jobs:
       # [SkippableFact] + Skip.IfNot(SandboxCredentials.IsAvailable, ...) (see
       # tests/Monnify.IntegrationTests/SandboxCredentials.cs) so they report as skipped here,
       # not failed - this runner has no MONNIFY_SANDBOX_API_KEY/SECRET_KEY configured on purpose.
-      # Skipped tests contribute no coverage, so the uploaded report below reflects
-      # Monnify.Tests (unit tests) only - that's the intended, reproducible signal.
       - name: Test
-        run: dotnet test --configuration Release --no-build --collect:"XPlat Code Coverage" --results-directory ./coverage
+        run: dotnet test --configuration Release --no-build
 
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          directory: ./coverage
-          use_oidc: true
-          fail_ci_if_error: true
+      # Coverage is collected from Monnify.Tests only (run separately from the line above) -
+      # IntegrationTests' skipped tests never execute SUT code, so including that project's
+      # report would just dilute the denominator with the same assembly's line count again.
+      - name: Test with coverage
+        run: dotnet test tests/Monnify.Tests/Monnify.Tests.csproj --configuration Release --no-build --collect:"XPlat Code Coverage" --results-directory ./coverage
+
+      # No external service required - just parses the cobertura report coverlet already
+      # produces and fails the build below a fixed line-coverage floor. Current baseline is
+      # ~95%; 85% leaves headroom for routine work while still catching a real regression.
+      - name: Check coverage threshold
+        run: |
+          python3 - <<'PY'
+          import glob, sys, xml.etree.ElementTree as ET
+
+          THRESHOLD = 85.0
+          files = glob.glob("./coverage/**/coverage.cobertura.xml", recursive=True)
+          if not files:
+              sys.exit("No coverage report found")
+
+          root = ET.parse(files[0]).getroot()
+          covered = int(root.get("lines-covered"))
+          valid = int(root.get("lines-valid"))
+          pct = 100 * covered / valid if valid else 0
+
+          print(f"Line coverage: {pct:.2f}% ({covered}/{valid})")
+          if pct < THRESHOLD:
+              sys.exit(f"Coverage {pct:.2f}% is below the {THRESHOLD}% threshold")
+          PY
 
       # Validates the package actually builds correctly across both target frameworks - this is
       # NOT a publish step, nothing here touches NuGet.org. No artifact is uploaded either, since