Fix Codecov PGP key fetch in coverage upload (release/26.8)

[nbradbury]

Backport of #22963 to release/26.8.

Summary

CI was failing in the Uploading code coverage step because curl https://keybase.io/codecovsecurity/pgp_keys.asc now returns a 32-byte HTTP 404 (SELF-SIGNED PUBLIC KEY NOT FOUND). That body gets piped into gpg --import, gpg fails with "no valid OpenPGP data found", and set -e aborts the rest of the run-unit-tests script before merge_junit_reports runs.

Codecov appears to have renamed their Keybase account from codecovsecurity to codecovsecops. The new URL serves the same signing key (fingerprint 27034E7FDB850E0BBC2C62FF806BB28AED779869, key ID ED779869).

Changes

• Update the keybase URL: codecovsecurity → codecovsecops.
• Add --fail --silent --show-error to the curl call so the next time this URL moves, curl exits non-zero with a clear error instead of silently piping a 404 page into gpg.

Test plan

• CI green on this PR (the coverage upload step in particular).
• Codecov report appears on the PR.

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr22964-01d07d0
	Build Number	1493
	Application ID	com.jetpack.android.prealpha
	Commit	01d07d0
	Installation URL	4pff78e3l3aio

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr22964-01d07d0
	Build Number	1493
	Application ID	org.wordpress.android.prealpha
	Commit	01d07d0
	Installation URL	2abckd5re5fb8

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[adalpari]

✅ Codecov report verified via API

Confirmed the coverage upload now works end-to-end. Queried the Codecov API for commit 01d07d0:

Field	Value
State	complete (Codecov finished processing)
CI passed	true
Sessions	1 (upload received)
Coverage	37.34%

PR comparison (Codecov pulls/22964 endpoint): base 37.34% → head 37.34% — both totals present and compared.

This confirms the keybase URL fix (codecovsecurity → codecovsecops) restores the upload: without it, run-unit-tests.sh aborted under set -e before the upload ran and Codecov received 0 sessions.

Full report: https://app.codecov.io/gh/wordpress-mobile/WordPress-Android/pull/22964

Note: the report is uploaded and processed on Codecov, but no Codecov status check/comment is auto-posted on the GitHub PR — that's a separate Codecov GitHub-integration config matter, unrelated to this script fix.

[adalpari]

LGTM!