… 8.0.0"" (#1929)

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" …"

This reverts commit 87d39f4.

* chore(release): 5.5.4

* chore(release): 6.0.0

* fix: small fixes

---------

Co-authored-by: Tom Hu <tomhu1096@gmail.com>

Replace direct ${{ inputs.skip_validation }}, ${{ inputs.use_oidc }},
${{ inputs.token }}, and ${{ env.CODECOV_TOKEN }} interpolation inside
run: shell scripts with env-var indirection. GitHub Actions resolves
template expressions before the shell sees the script, so any consumer
workflow that passes user-controlled data into these inputs could
achieve arbitrary command execution on the runner. Moving the values
into env: entries and referencing them as $INPUT_* shell variables
ensures the shell always treats them as data, not code.

Removes the Enforce License Compliance GitHub Actions workflow.

Bump the wrapper submodule (src/scripts) to the latest main
(bad8df5), which fetches the Codecov Uploader PGP key from the
codecovsecops Keybase account, and cut a new major version.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore(release): 7.1.0

Bump the wrapper submodule to 0.3.0 and expose the new cleanup
input for downloading the CLI into a temporary directory.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: drop release-note README copy

Remove CircleCI and changelog-style release notes from README;
input docs remain in action.yml, upload.yml, and step.yml.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Bump wrapper submodule to 0.3.1 and regenerate dist/codecov.sh.

Co-authored-by: Cursor <cursoragent@cursor.com>