CI: workflow hygiene + coverage fold

[frazane]

First step in tidying up the CI workflow. This bumps stale action versions, removes some redundant setup, hardens permissions, and folds the separate coverage job into the test matrix so the same suite isn't run twice.

What changed

• Bumped actions to current majors: checkout v5, setup-uv v6, codecov-action v5.
• Let uv install/pin Python via setup-uv's python-version input and dropped the separate setup-python step; the lint job now caches too.
• Added a concurrency group so superseded runs are cancelled, and set fail-fast: false so one backend failing no longer cancels the other legs.
• Added top-level permissions: contents: read.
• Removed the standalone coverage job and added a single matrix leg (ubuntu, 3.13, all extras) that runs the full suite with coverage and uploads to Codecov.

Notes

• The test matrix is now 24 per-backend legs plus one coverage leg. Worth confirming the 3.14 jax/torch legs are happy with uv-managed Python.

[Copilot]

Pull request overview

This PR updates the GitHub Actions CI workflow to modernize action versions, reduce redundant setup, and avoid running the same test suite twice by folding coverage collection into the existing test matrix.

Changes:

• Bumped CI actions (checkout, setup-uv, codecov) and removed the separate setup-python step in favor of setup-uv’s Python management.
• Added workflow-level concurrency (cancel superseded runs) and tightened default permissions (contents: read).
• Removed the standalone coverage job and replaced it with a single matrix “coverage leg” that runs the full suite with coverage and uploads to Codecov.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.