ci(coverage): don't fail the gate when the badge update errors (#786)

The "Update coverage badge" step runs only on push to main and authenticates
to the gist with GIST_TOKEN. An expired/invalid GIST_TOKEN returns 401 and
failed the whole Coverage job — even though coverage itself (the tarpaulin
fail-under gate in "Run coverage") passed. The badge is cosmetic, so mark the
step continue-on-error: a stale badge secret no longer reds the CI gate.
(The badge still won't refresh until GIST_TOKEN is rotated.)

Author: devitway

.github/workflows/ci.yml

@@ -133,7 +133,10 @@ jobs:
       - name: Update coverage badge
         # Badge needs the GIST_TOKEN secret and only makes sense for the
         # canonical branch — skip on PRs (incl. forks without secrets).
+        # Cosmetic: a stale/expired GIST_TOKEN (e.g. a 401) must not fail the
+        # Coverage gate — the real fail-under check is the "Run coverage" step.
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        continue-on-error: true
         uses: schneegans/dynamic-badges-action@0e50b8bad39e7e1afd3e4e9c2b7dd145fad07501 # v1.8.0
         with:
           auth: ${{ secrets.GIST_TOKEN }}