There are three distinct problems with codecov:

1. I found it to be configured (for dask/dask only) to use master as the primary branch. I've already fixed this in the control panel.
2. It has failed on pushes to main for the last year, with the message

error - 2025-12-30 22:27:57,030 -- Upload failed: {"message":"Token required because branch is protected"}

The result is that both the aggregated % and the final report in PRs are nonsensical, as they run on the delta from main as of 1 year ago.

3. codecov becomes transitorily red while CI is running. It should only post its output after all gha jobs have completed.