ci: give only the badge deploy write access; drop the duplicate tox run

[allen0099]

Summary

Closes #193

Part of #124.

coverage.yml: only the badge deploy can write

Until now, contents: write applied to the whole workflow. That included the job that installs dependencies and runs the test suite on every pull request from this repository.

Changes:

• The workflow is now contents: read.
• The deploy moved into its own badge job.
  • It runs only on a push to master, after coverage.
  • It is the only job with contents: write.
  • It gets coverage.svg from the coverage job as an artifact. The artifact is uploaded on pushes only and kept for one day.
  • It has a coverage-badge concurrency group, so deploys from back-to-back pushes do not race on the branch.
• The deploy now publishes only the badge.
  • Before, it deployed folder: ., which is the whole checkout. The coverage-badge branch therefore holds a copy of the source tree next to coverage.svg, including files master deleted long ago.
  • With clean: true, the first deploy after this merges leaves only coverage.svg on that branch. The README badge reads only that file.
• genbadge[coverage] is now quoted in the shell step (shellcheck SC2102; the brackets are a glob).

test.yml vs tox.yml: one matrix run

tox.yml ran uv run tox on one runner, which runs py310 through py314 one after another. Each env:

• uses uv-venv-lock-runner, which runs uv sync --locked with the default dev group (PyJWT included);
• adds the redis and memcached extras;
• runs against the same live Redis/Memcached services.

That is the same set of versions, packages and servers as the test.yml matrix. test.yml also runs each version as a separate job, which is faster and makes failures easier to read.

Roles after this PR:

Workflow	Role
Test (test.yml)	The one CI run of the 3.10–3.14 matrix, with live servers. Now declares contents: read explicitly. Its README badge is unchanged.
Coverage Badge (coverage.yml)	3.14 coverage report (gate 90%). Badge deploy on push.
tox (tox.ini)	Local use only. docs/DEVELOPMENT.md says so. tox.yml is removed.

The trade-off is that nothing in CI exercises tox.ini itself any more, so a broken tox.ini would surface only in a local run.

A run against the lowest supported dependency versions (#194) fits as a separate job in test.yml. A comment above the matrix job marks the spot.

Verification

• actionlint 1.7.12 with shellcheck, over all six workflow files in the branch (coverage.yml, docs.yml, lint.yml, release.yml, renovate-validate.yml, test.yml): no findings. The SC2102 finding it reports on master's coverage.yml is gone.
• uv run tox -e py314 works locally. It confirms what the tox env installs: uv sync --locked --extra memcached --extra redis, with the dev group, so PyJWT and pytest are included.
• zensical build --strict for the English docs passes. DEVELOPMENT.md has no zh-TW copy.
• pre-commit passes, and uv lock --check passes.
• A pull request cannot run the badge job. The first real deploy is the push to master after merging. What to check then:
  • the coverage-badge branch holds only coverage.svg;
  • the README badge still renders.

CHANGELOG

None: CI only.