[codex] Fix GitHub Actions workflow

[ZenulAbidin]

What changed

This updates the GitHub Actions CI workflow so it can be parsed and executed again.

Why

The workflow was referencing secrets.CODECOV_TOKEN directly in the step-level if: expression. That can cause GitHub to reject the workflow before any jobs are scheduled. The workflow now exposes the token through job-level environment and checks env.CODECOV_TOKEN instead.

This PR also keeps the workflow aligned with the repository's current Python support matrix (3.10 through 3.14) and moves the Codecov upload to the 3.14 job.

Impact

Pushes to this branch and the PR should now run the CI workflow normally instead of failing at workflow evaluation time.

Validation

• python -m tox -e py310
• python -m tox -e py311
• python -m tox -e flake8
• python -m tox -e docs

Root cause

GitHub Actions workflow evaluation was broken by the direct secret reference in the conditional expression, which prevented the workflow from scheduling jobs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.39%. Comparing base (f55d123) to head (d1c6f08).
⚠️ Report is 15 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #16      +/-   ##
==========================================
+ Coverage   62.49%   66.39%   +3.89%     
==========================================
  Files         134      135       +1     
  Lines        4917     5008      +91     
  Branches      712      754      +42     
==========================================
+ Hits         3073     3325     +252     
+ Misses       1652     1425     -227     
- Partials      192      258      +66     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ZenulAbidin]

Merging the workflow fixes now that the PR checks are green. This PR contains only the four committed workflow updates on codex/fix-github-actions-workflow; unrelated local worktree changes are not part of the merge.