fix(ci): switch fetch-test-timing.mjs to Codecov's test-analytics endpoint

[JSONbored]

Summary

scripts/fetch-test-timing.mjs (added in the duration-aware sharding PR, #7381) called Codecov's /test-results/ endpoint. You manually ran test-timing-refresh.yml via workflow_dispatch and it failed immediately with a live 301: "This endpoint has been deprecated. Please use /test-analytics/ instead." — Codecov apparently deprecated it after the original research for #7381 checked their spec, or the finding was already stale by the time it shipped.

Fixed by pointing at /test-analytics/ instead. Verified against Codecov's live OpenAPI schema (api.codecov.io/api/v2/schema/) that the replacement endpoint returns the identical PaginatedTestrunList wrapper and Testrun field shape (filename, duration_seconds, commit_sha, etc.) — a pure URL rename, so the aggregation logic in the rest of the file is untouched.

Until this merges, test-timing-refresh.yml fails every run, so compute-test-shards.mjs keeps using its round-robin fallback (safe, already verified — just not the actual duration-weighted balancing this whole feature exists for).

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused — a single-line URL fix plus an explanatory comment.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — N/A, maintainer-initiated build-tooling work.

Validation

• git diff --check
• npm run actionlint
• node --check scripts/fetch-test-timing.mjs
• Confirmed the new endpoint's response schema is identical to the old one via Codecov's live OpenAPI schema before assuming the URL-only fix was sufficient, rather than just swapping the string and hoping.
• Can't verify the live API call itself in this session (no access to CODECOV_API_TOKEN, by design) — the real end-to-end check is the next scheduled/manual run of test-timing-refresh.yml after this merges.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.

Notes

• Touches only a script under scripts/, not .github/workflows/** itself — may not need the same manual-hold treatment as the workflow-file PRs this session, but flagging since it's still CI-adjacent infrastructure.
• Worth a manual workflow_dispatch re-run of test-timing-refresh.yml after this merges to confirm the fix actually works end-to-end, not just that the URL matches the deprecation notice's stated replacement.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.21%. Comparing base (09b028c) to head (a910c51).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7403   +/-   ##
=======================================
  Coverage   91.21%   91.21%           
=======================================
  Files         716      716           
  Lines       72789    72789           
  Branches    20859    20859           
=======================================
  Hits        66392    66392           
  Misses       5355     5355           
  Partials     1042     1042           

Flag	Coverage Δ
shard-1	35.90% <ø> (ø)
shard-2	41.32% <ø> (ø)
shard-3	38.95% <ø> (ø)
shard-4	39.92% <ø> (ø)
shard-5	27.14% <ø> (ø)
shard-6	31.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.