Finish Codecov coverage reporting after the JuliaData transfer

[mathieu17g]

Coverage is measured in CI (julia-runtest → julia-processcoverage → codecov-action@v7), but it hasn't reported since the move to JuliaData: uploads are tokenless and Codecov has no data under JuliaData/XML.jl, so there's no coverage badge and no per-PR coverage comments. The goal is to restore full coverage reporting — a rendered badge plus per-PR patch and project coverage.

Tasks

• Point the CI badge at JuliaData (it still targets JuliaComputing, working only via redirect) and add .github/codecov.yml (informational status + PR-comment layout for patch & project coverage)
• Grant Codecov's GitHub App access to JuliaData/XML.jl — org-owner only: "Update Codecov's repository access" returns "This action must be performed by an organization owner." cc @ViralBShah / @quinnj
• Obtain the repo upload token (codecov.io → JuliaData/XML.jl → Settings) — currently inaccessible (Codecov treats me as a visitor on the repo)
• Add CODECOV_TOKEN as an Actions secret and wire it in CI.yml (token: ${{ secrets.CODECOV_TOKEN }}) — repo-admin, once the token is available
• Re-add the coverage badge to the README (renders once data lands)

Result when complete

The badge renders a real %, and PRs get a Codecov comment with patch (diff) and project (whole-package) coverage — the codecov.yml layout already configures both; it just needs data flowing.

---

The first task is partially addressed by #71 (CI-badge URL + codecov.yml); the rest is blocked on the Codecov org-owner items above.