fix(ci): publish coverage badges to a dedicated branch instead of main

[alejouribesanchez]

Problem

The Commit Code Coverage Image to Repo step of Veryfi-php main update fails on every push to main:

Error: Pushing to https://github.com/veryfi/veryfi-php
remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.

main is protected and only accepts changes through pull requests, so the built-in GITHUB_TOKEN can never push the regenerated badges to it. No amount of retrying or reconfiguring EndBug/add-and-commit can succeed against that rule. The same run also emits set-output deprecation warnings from that action (v5 predates environment files) and a Node 20 deprecation warning from actions/checkout@v2.

Fix

Publish the badges to a dedicated, unprotected badges branch instead of committing them to main.

• New .github/scripts/publish_badges.sh commits metrics/code_coverage.svg and metrics/methods_coverage.svg onto the badges branch, creating it as an orphan branch on the first run and appending to it afterwards. It is a no-op when coverage has not changed, so it produces no empty commits, and it keeps the Github actions <veryfi@veryfi.com> commit identity and Update report message the old step used.
• main.yml replaces the EndBug/add-and-commit@v5 step with that script, which also removes the deprecated set-output warnings. The workflow declares contents: write and a main-update concurrency group so concurrent pushes cannot race on the badge branch.
• actions/checkout@v2 is bumped to v5 in both workflows, clearing the Node deprecation warning (v4 still targets Node 20). php.yml also gets an explicit read-only permissions block.
• README.md points its badges at raw.githubusercontent.com/veryfi/veryfi-php/badges/metrics/*.svg and now shows methods coverage alongside code coverage.

The coverage gate is unchanged: metrics/generate_badges.py still fails the build when statement coverage drops below 92%.

Verification

PHP Unit testing on this PR is green with zero deprecation warnings in the log (run 32503840817): 179 tests, 676 assertions, badges generated at 97.8% code / 98.9% methods coverage.

The publishing step only runs on pushes to main, so it was verified against a local remote whose main rejects pushes with the exact GH006 message GitHub returns, using the real phpunit --coverage-clover and generate_badges.py output:

• the old flow reproduces the reported failure,
• the new script creates the badges branch when it is missing,
• a second run with identical coverage publishes nothing,
• a run with changed coverage adds a commit and the published SVG carries the new value,
• the remote main ref is never touched, and no worktrees or temporary branches are left behind.

The same scenarios were replayed from a depth=1 checkout (what actions/checkout produces) and from a subdirectory. actionlint reports no issues on both workflows and shellcheck reports none on the new script.

Note for reviewers

This assumes only main is protected. If an organization ruleset requires pull requests on every branch, the badges branch push would be rejected too, and the alternative is a PAT with bypass permission stored as a repository secret.