ci: run CI on merge groups, and drop the Codecov upload token - #469

Two changes that make a merge queue workable here.

ci.yml gains a merge_group: trigger. A queue grades the merge commit it
builds against the same required checks the pull request carries, so a check
whose workflow does not trigger there never reports — which is a hang rather
than a failure: the entry waits out the status-check timeout and is evicted.

The Codecov uploads move from CODECOV_TOKEN to the job's own short-lived
OIDC token. A queued pull request runs the workflow file from its own merge
commit on a base-repo ref, which widens the set of authors who can reshape the
job that holds a long-lived credential.

Enabling the queue is a settings change this branch cannot make

In this order, after merge:

1. Drop CodeQL from the required status checks. The code-scanning
   roll-up check does not report on merge groups
   (github/codeql-action#1537,
   still open), so a queue that requires it stalls every entry until the
   timeout evicts it. The ruleset's code_scanning rule goes on covering pull
   requests.
2. Turn off "require branches to be up to date" — the queue supersedes it.
3. Restrict the pypi environment's deployment branches to tags (v*), as
   github-pages already restricts to main. pypi currently has
   protection_rules: [] and no branch policy, and release.yml's
   publish-pypi job declares that environment with id-token: write and
   publishes to PyPI by trusted publishing. Under a queue, a pull request could
   add merge_group: to release.yml and strip that job's if:; PyPI
   validates the workflow filename and the environment, and both would match.
   Queuing needs write access, so this is a precondition rather than a live
   hole — but no in-file guard can substitute, since the same merge commit owns
   the file that would carry it.
4. Add the merge_queue rule.

Worth looking at closely

The Codecov step on this PR's own run. If the server declines the OIDC token,
fail_ci_if_error: false swallows it and nothing goes red, and neither
codecov/patch nor codecov/project is a required context. Confirm those two
post before deleting the CODECOV_TOKEN repository secret; nothing in the tree
references it any more.