codecov: revalidate @codecov/vite-plugin's Vite 8 compatibility once upstream declares support

[qnbs]

Context

@codecov/vite-plugin@2.0.1 declares peerDependencies: { vite: "4.x || 5.x || 6.x" }. This repo
runs Vite 8 with Rolldown (vite: "^8.2.1"). The plugin is wired into vite.config.ts (#605) despite
this declared mismatch, based on empirical verification rather than the upstream peer contract:

1. An isolated scratch-project build (npm install --legacy-peer-deps + vite build) against plain
   Vite 8.2.1 — clean build, plugin hooks ran correctly.
2. A real production build of this repo's actual vite.config.ts — PWA injectManifest (2503
   precache entries), manual chunking, Tailwind, React, workspace aliases, the conditional
   rollup-plugin-visualizer — with CODECOV_BUNDLE_ANALYSIS=true and no token. Clean build, service
   worker generated correctly, dist/bundle-analysis.html produced, no source maps, no secret
   leakage.
3. Real GitHub Actions CI on ci: add Codecov bundle and test analytics #605's own PR (with a real CODECOV_TOKEN) — see that PR/its merge
   commit for the actual ingestion evidence (bundle name, upload duration, any Codecov-side warnings).

This is empirically-verified compatibility outside the plugin's own declared peer contract, not a
false positive to dismiss and not a normal source bug to silently patch around. No pnpm override,
packageExtensions peer-range broadening, or Vite downgrade was applied — the exact plugin pin and
the repo's real Vite/Rolldown setup are both unchanged from their natural versions.

What this issue tracks

Revalidate (or remove) this exception once @codecov/vite-plugin officially declares Vite 7/8
support in its peerDependencies:

• Check npm view @codecov/vite-plugin peerDependencies for a version range that includes 8.x.
• If found, bump the pin, re-run the same empirical verification (real build against this repo's
  actual vite.config.ts, not just a trivial scratch project), and remove this issue.
• If @codecov/vite-plugin is abandoned or Codecov ships a different bundler-analysis mechanism
  before that happens, close this issue with that disposition instead.

Not urgent — the current integration is working, informational-only (codecov.yml's
bundle_analysis.status: "informational"), and does not block any existing gate. This is process
hygiene: an intentionally-accepted peer-contract gap should have a durable place to be revisited,
not just a comment buried in a merged PR.