refactor: update ci workflows

[akrem-chabchoub]

Checklist

• I have read the coding guide.
• My change requires a documentation update, and I have done it.
• I have added tests to cover my changes.
• I have filled out the description and linked the related issues.

Description

Open API Spec Version Changes (if applicable)

Motivation and Context (Optional)

Related Issue (Optional)

Screenshots (if appropriate):

AI Disclosure

• This PR contains code that has been generated by an LLM.
• I have reviewed the AI generated code thoroughly.
• I possess the technical expertise to responsibly review the code generated in this PR.

[darkobas2]

CI review

1. Blocker — renamed checks break required contexts

master requires: Integration tests, Test (macos-latest), Test (windows-latest), Test (ubuntu-latest), Lint.

This branch only reports Lint; the rest were renamed (Test (Linux, shard 0..3), Build check (…), Integration tests (chain|data)). GitHub waits forever on a context that never reports — that's why this PR is BLOCKED, and since contexts are set on the base branch, merging blocks every other open PR too.

Simplest fix, no admin change and no rebases: keep the old names as gate jobs.

  test-linux-gate:
    name: Test (ubuntu-latest)
    needs: [test]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - run: '[ "${{ contains(needs.*.result, ''failure'') || contains(needs.*.result, ''cancelled'') }}" = "false" ]'

Four of these covers all four contexts. @gacevicljubisa — or would you rather repoint branch protection?

2. This fixes Trigger Beekeeper, which has been dead on master since 2026-06-08

master has needs: [test, lint, coverage]; coverage fails every run, and a failed needs: skips the dependent job. This branch drops coverage — correct call.

3. Codecov

Fails with Could not verify signature (Codecov verifying its own uploader, not our keys — our GPG secrets are release-signing only, used in release.yaml). With fail_ci_if_error: true (go.yml:133) that's a hard failure, so master stays red. Suggest false.

4. SonarCloud

Two githubactions:S7636 at beekeeper.yml:245,254 — ${{ secrets.TUNSHELL_KEY }} expanded in run:. Move to env: and use ${TUNSHELL_KEY}. Same pattern at :257 (TUNSHELL_SECRET, unflagged as unchanged).

Minor

• go.yml:57 — NR % 4 hardcodes the shard count separately from shard: [0,1,2,3]; drift silently drops packages.
• beekeeper.yml:153 — VERTAG: ${GITHUB_RUN_ID}-… isn't expanded in env:; use ${{ github.run_id }}.
• macOS/Windows now only build, no tests. Intentional?