TealCompile matched any 58 character base32 string and kept matching, so the
last one won. compile now reports the salted address after the program hash,
which made the helper return the wrong one of the two, and every test that
funds the address it returns spent from an account it had not funded:
goalLogicSigTest, limitOrderTest and tealAndStatefulTealTest.

It keeps the first match now, which is the program hash it has always
returned. TealCompileSign is unaffected, since compile prints no address when
it is signing, and tealConsensusTest already stops at the first match.

Also add the t.Parallel that TestAuthorizeWithProgram was missing. cmd is the
one tree the paralleltest linter is not excluded from.

docs: clarify reference array offsets for accounts and applications

A program has two account addresses, so goal needs a way to say which one a
transaction is authorized by. --salted picks the salted one; without it, the
form is taken from whichever address the transaction's authorizer already
matches, and failing that the program hash, so that existing uses keep the
address and the behavior they had. That leaves --salted needed only where
nothing else settles it: clerk send -F with no --from and no --signer, where
the program's address becomes the sender.

Reading the form off the authorizer rather than the sender is what makes a
rekeyed account work: --signer names the authorizer, and that is the address
the program has to match.

LogicSigSanityCheck now covers whichever form a transaction uses, so goal
still checks a program before submitting it.

clerk send's -L branch built its transaction without the AuthAddr that -S had
asked for, while the -F branch beside it set one. Both now go through the same
path, so -L no longer silently drops --signer.

scripts/coverpkg.sh decides which packages are instrumented and
.codecov.yml decides which files are counted. The two had nothing in
common: the command line programs, the build and debug tools, the e2e
tree and the test-support packages were dropped from measurement without
being mentioned here, so 158 files and 18,273 lines went quietly
uncounted rather than deliberately excluded.

List them, so the two descriptions of one decision sit together. This
changes no numbers -- Codecov never saw those files -- it only makes the
exclusion legible, and gives the next person something to change when the
measured set changes.

Two measured packages still go uncounted: no test binary links daemon/kmd
or netdeploy/remote/nodecfg, so they produce no coverage data and covdata
has nothing to emit for them. That is 431 lines, all uncovered, worth
0.4pp on the total.

Concurrency is evaluated per workflow run, before the job conditions that
check for /coverage and the commenter, so any comment on the pull request
joined the group and cancelled a run in progress while starting nothing
in its place. Key the group on the run id unless the comment is a request
the authorize job would accept -- including the author check, or anyone
at all could cancel a run by typing /coverage.

Check out the commit resolved during authorization rather than
refs/pull/N/head. That ref moves, so a push while the partitions were
queued could leave them testing different commits from each other and
from the one the upload is attributed to.

Coverage is now always measured across every package, so "full" no longer
distinguishes it from anything. Name the flag after what produced it,
leaving room for an e2e flag beside it later.

Starting a new flag also leaves the old series alone rather than erasing
it: once this is on master, push builds fill the new one with reports
that are measured correctly, and comparisons are right from then on.

Drop the workflow_dispatch input along with it. It ran against a ref
rather than a pull request, so its upload could never be attached to one,
and dispatching ci-pr.yml pulled the whole integration and e2e suite
along to reach the one job that measured anything. Commenting /coverage
does that job properly, so ci-pr.yml no longer deals with coverage at all.

pr-coverage.yml repeated the test invocation and coverage plumbing that
ci-pr.yml and ci-nightly.yml already had. Move it into a composite action
alongside setup-go and setup-test, parameterised by what actually differs
between the three: -short, -p, where test results go, and whether
coverage is measured.

Nightly now measures coverage only on ubuntu-24.04. The other two
platforms were paying for instrumentation whose output was never
uploaded.

Also shorten the comments added along with these workflows.

Project coverage is the least trustworthy number in the comment: it
compares against whichever commit last had an upload, and moves with the
file set as readily as with the tests. Hide it and report patch coverage.

Add components for the subsystems reviews are drawn around, so a ledger
change is measured against ledger rather than against go-algorand.

Wait for every partition before commenting, so a comment is never written
from part of a run. Only pull requests are commented on, so push builds,
which upload two reports rather than six, are unaffected.

PR builds no longer measure coverage, so nothing reports the coverage of
a change before it merges. Add a workflow that does it on request:
commenting "/coverage" on a pull request runs the full -coverpkg suite
against its head and uploads the result to Codecov attached to that pull
request, where it can be compared against the baseline the push build
publishes for the merge base.

The run is measured the same way as the push build -- same tags, -race,
no -short, CIRCLECI set -- so the two are comparable. Only the
partitioning differs, 6 runners instead of 2, which changes how tests are
spread but not which of them run.

Codecov is given the head commit, branch and pull request number
explicitly. issue_comment workflows run with the default branch checked
out, so an upload left to infer its own context would be attributed to
master and would overwrite the baseline. A fork's branch is named
"owner:branch", matching Codecov's convention.

Only OWNER, MEMBER and COLLABORATOR comments trigger it, since it builds
and runs the pull request's code. The workflow itself always runs from
the default branch, so a pull request cannot change what it does, and the
job that checks the branch out holds only contents:read and no secrets;
the write permission needed to acknowledge and report lives in separate
jobs that never check out the branch.

Extract the -coverpkg package list to scripts/coverpkg.sh rather than
adding a fourth copy of it; the Makefile and both existing workflows now
use it too. Verified to produce the same 112 packages as the pipeline it
replaces.

Move the coverage uploads to codecov-action@v7, which replaces "file"
with "files", and drop scripts/travis/upload_coverage.sh, which nothing
has referenced since CircleCI went away.