chore(metrics): make Octocov publication non-mutating and failure-visible

[ggfevans]

Parent

Part of #1276

Summary

Refactor Octocov metrics publication to avoid direct pushes to main from CI and make failures visible/actionable.

Problem

Current workflow can mutate repository state directly and may hide failures via permissive error handling.

Acceptance Criteria

• Remove direct git push to main from workflow execution path.
• Publish metrics/badges via safer path (artifact, PR automation, or dedicated branch strategy).
• Make publication failures visible (no silent pass for critical steps).
• Document operational fallback when publication fails.

Notes

Keep existing metric generation value while reducing repo mutation risk.