fix(ci): bump codecov-action to v6.0.2 to fix GPG signature failures

[cijothomas]

The coverage CI job has been failing since 2026-06-09 with:

==> Could not verify signature. Please contact Codecov if problem continues
##[error]Process completed with exit code 1.

Root cause

codecov/codecov-action@v6.0.1's upload script downloads its GPG public key from https://keybase.io/codecovsecurity/pgp_keys.asc, which now returns 404 SELF-SIGNED PUBLIC KEY NOT FOUND due to a Keybase account migration. The script uses curl -s without --fail, so the 404 body is piped into gpg, the key import fails, and signature verification fails.

Tracked upstream in codecov/codecov-action#1955.

Fix

Bump codecov/codecov-action from v6.0.1 to v6.0.2. Per the v6.0.2 release notes, it is an exact copy of v7.0.0 made specifically to ease upgrades from the v6 line — no breaking changes.

Companion to open-telemetry/opentelemetry-rust-contrib#638.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.8%. Comparing base (2571776) to head (664f120).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #3547     +/-   ##
=======================================
- Coverage   82.9%   82.8%   -0.1%     
=======================================
  Files        130     130             
  Lines      27350   27353      +3     
=======================================
  Hits       22675   22675             
- Misses      4675    4678      +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.