refactor(test): extract Codecov logic to dedicated action with config fixes

actions/test/action.yml

@@ -201,6 +201,30 @@ runs:
           await io.mkdirP(gnupgHome);
           fs.chmodSync(gnupgHome, 0o700);
 
+    # Fix pkgxdev curl's .curlrc which contains unexpanded environment variables
+    - name: Fix curl configuration
+      if: always() && contains(steps.check-codecov-deps.outputs.missing-deps, 'curl')
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      with:
+        script: |
+          const fs = require('node:fs');
+          const path = require('node:path');
+
+          // Find and fix the .curlrc file that contains unexpanded shell variables like ${SSL_CERT_FILE:-...}
+          // The pkgxdev curl installs .curlrc next to the curl binary
+          try {
+            const curlPath = await io.which('curl', false);
+            if (curlPath) {
+              const curlrc = path.join(path.dirname(curlPath), '.curlrc');
+              if (fs.existsSync(curlrc)) {
+                core.info(`Removing malformed .curlrc: ${curlrc}`);
+                await io.rmRF(curlrc);
+              }
+            }
+          } catch (error) {
+            core.warning(`Failed to check/remove .curlrc: ${error.message}`);
+          }
+
     - name: 📊 Upload coverage to Codecov
       if: always() && inputs.coverage == 'codecov'
       uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1