ci: Fix codecov project check on merge to main

[fabisev]

Issue #, if available:

Description of changes:

Problem

Some merges to main fail codecov/project even when the merged tree is unchanged. Last case (PR #629): "65.38% (-0.41%) compared to 7b484d3" (a drop on a tree that is byte-for-byte identical to the PR branch tip).

Root cause

PR builds upload coverage from two native matrix runners (x86_64 + aarch64), which Codecov merges into a union. Merge-to-main uploaded a single x86 report, so the merge commit measured slightly less coverage than its own base. With no codecov.yml, the default project status fails on any drop.

Codecov docs:

• https://docs.codecov.com/docs/merging-reports: "Codecov does not override report data for multiple uploads. We always merge the data."
• https://docs.codecov.com/docs/unexpected-coverage-changes, reason 2: "a different number of reports between head and base."

Fix

.codecov.yml (new):

• project.threshold: 1%: tolerate sub-1% noise.
• patch: off: project coverage is the gate.
• carryforward: true: Codecov's recommended remedy for commits that don't re-upload every report (https://docs.codecov.com/docs/carryforward-flags).

Workflows:

• PR: tag each matrix upload with flags: ${{ matrix.arch }} + explicit JaCoCo path.
• Merge-to-main: add a two-arch coverage matrix job so main and PR record the same union of reports (also gives carryforward a real per-arch baseline).

Result

Merges compare the union of both archs against a like-for-like base, so measurement noise no longer fails the build.

Target (OCI, Managed Runtime, both):

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.79%. Comparing base (fffd1b4) to head (bf86c36).

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #642      +/-   ##
============================================
+ Coverage     65.38%   65.79%   +0.40%     
- Complexity      213      214       +1     
============================================
  Files            34       34              
  Lines           991      991              
  Branches        143      143              
============================================
+ Hits            648      652       +4     
+ Misses          290      287       -3     
+ Partials         53       52       -1     

Flag	Coverage Δ
aarch64	65.79% <ø> (?)
x86_64	65.38% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[darklight3it]

I think it's fine, only add the permissions.