coverage: Don't panic if flag.CommandLine is reassigned - #4384

### What does this PR do?

This PR ports #52373 onto the current `main` branch and makes Datadog the sole code-coverage backend.

#### Remove the redundant Codecov integration

**Before:** CI uploaded coverage to both Codecov and Datadog. This required a Codecov secret, configuration, helper code, tests, and documentation badges.

**Now:** Codecov configuration, credentials, upload steps, helpers, tests, and badges are removed. Datadog Code Coverage remains the supported backend.

**Impact:** There is one less external integration and secret to maintain, without losing coverage reporting.

#### Separate coverage-cache management from report submission

**Before:** S3 cache management was coupled to the coverage upload step. Reusing that step for additional jobs would also make them pull or push the shared cache, even when they already generated complete reports.

**Now:** CI has separate operations for:

- Managing the S3 coverage cache.
- Uploading a report to Datadog.

Impacted-package jobs run both operations. Flavor and Bazel jobs upload their reports without modifying the shared cache.

**Impact:** Fast test jobs still merge cached coverage from unaffected packages, while additional uploaders cannot overwrite or race on cache entries they do not own.

#### Submit previously unreported Linux flavor coverage

The following jobs already generated `coverage.out`, but only uploaded JUnit results and retained coverage as a CI artifact:

- `tests_flavor_iot_linux-x64`
- `tests_flavor_dogstatsd_linux-x64`
- `tests_flavor_heroku_linux-x64`

They now upload their coverage reports to Datadog.

**Impact:** Coverage from flavor-specific code paths is now included in the aggregate coverage view instead of remaining only in GitLab artifacts.

A shared `.linux_flavor_tests` template also removes duplicated job configuration.

#### Submit Bazel coverage reports

The following jobs generated named coverage artifacts but did not submit them to any backend:

- `bazel:coverage:linux-amd64`
- `bazel:coverage:linux-arm64`
- `bazel:coverage:macos-amd64`
- `bazel:coverage:macos-arm64`

They now pass their `coverage-bazel-*.out` reports to the shared Datadog upload step.

**Impact:** Bazel coverage is visible in Datadog and can be compared with the legacy gotestsum coverage while the repository transitions toward Bazel-based testing.

#### Fix the GPU coverage submission

**Before:** `tests_gpu` attempted to upload coverage, but `gocovmerge` produced a zero-byte profile. Datadog rejected it because a Go coverprofile must begin with a `mode:` header. The upload was non-fatal, so the job remained green even though no report was accepted.

**Now:** If a merged profile is empty, the coverage helper adds the configured Go coverage mode header. Non-empty profiles are left unchanged.

**Impact:** The GPU job now submits a syntactically valid report and is recorded by Datadog instead of failing silently.

#### Fix Windows coverage submission

**Before:** `tests_windows-x64` generated coverage and merged the S3 cache correctly, but its upload attempted to execute `datadog-ci.exe`, which was unavailable in the build image. Direct PowerShell resolution of `datadog-ci` also failed, while the job remained green because uploads are non-fatal.

**Now:** A dedicated Invoke task resolves the platform-specific `datadog-ci` command with `shutil.which` and executes it through Python. This follows the same command-resolution pattern already used successfully by Windows JUnit uploads.

**Impact:** Windows coverage now reaches Datadog and contributes to the same commit-level aggregate as Linux and macOS coverage.

#### Preserve E2E coverage without Codecov coupling

**Before:** E2E profile conversion also read Codecov-specific metadata and uploaded to Codecov before Datadog processed the converted profiles.

**Now:** E2E coverage folders are converted directly into Go coverprofiles for Datadog. Conversion no longer depends on Codecov metadata.

**Impact:** Existing E2E coverage remains available while the conversion pipeline is simpler and backend-independent.

### Motivation

The repository already used Datadog Code Coverage, so maintaining Codecov in parallel added secrets, configuration, and CI work without providing a necessary capability.

At the same time, several jobs generated useful reports that Datadog never received, and the GPU and Windows upload paths failed silently. This change removes the redundant integration while making the Datadog submission path complete and verifiable.

### Describe how you validated your changes

- `dda inv invoke-unit-tests.run --tests=coverage,go --directory=tasks/unit_tests --no-buffer --verbosity=1`
- `dda inv linter.releasenote-unique-ids`
- `dda inv linter.full-gitlab-ci -t main --pre-push-linters --fail-fast --verbosity=2`
- The [pipeline](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/pipelines/132663591) passed.
- Datadog [confirmed](https://app.datadoghq.com/ci/code-coverage/github.com%2Fdatadog%2Fdatadog-agent/pull-requests/55278) all 11 expected non-E2E reports were ingested.

### Additional Notes

Windows Bazel jobs remain test-only because `rules_go 0.63.0` [does not](bazel-contrib/rules_go#4384 (comment)) reliably support Bazel coverage on Windows. `tests_windows-x64` remains the supported Windows coverage producer.

Co-authored-by: nikita-tkachenko-datadog <nikita.tkachenko@datadoghq.com>
Co-authored-by: ofek.lev <ofek.lev@datadoghq.com>

### What does this PR do?

This PR ports #52373 onto the current `main` branch and makes Datadog the sole code-coverage backend.

#### Remove the redundant Codecov integration

**Before:** CI uploaded coverage to both Codecov and Datadog. This required a Codecov secret, configuration, helper code, tests, and documentation badges.

**Now:** Codecov configuration, credentials, upload steps, helpers, tests, and badges are removed. Datadog Code Coverage remains the supported backend.

**Impact:** There is one less external integration and secret to maintain, without losing coverage reporting.

#### Separate coverage-cache management from report submission

**Before:** S3 cache management was coupled to the coverage upload step. Reusing that step for additional jobs would also make them pull or push the shared cache, even when they already generated complete reports.

**Now:** CI has separate operations for:

- Managing the S3 coverage cache.
- Uploading a report to Datadog.

Impacted-package jobs run both operations. Flavor and Bazel jobs upload their reports without modifying the shared cache.

**Impact:** Fast test jobs still merge cached coverage from unaffected packages, while additional uploaders cannot overwrite or race on cache entries they do not own.

#### Submit previously unreported Linux flavor coverage

The following jobs already generated `coverage.out`, but only uploaded JUnit results and retained coverage as a CI artifact:

- `tests_flavor_iot_linux-x64`
- `tests_flavor_dogstatsd_linux-x64`
- `tests_flavor_heroku_linux-x64`

They now upload their coverage reports to Datadog.

**Impact:** Coverage from flavor-specific code paths is now included in the aggregate coverage view instead of remaining only in GitLab artifacts.

A shared `.linux_flavor_tests` template also removes duplicated job configuration.

#### Submit Bazel coverage reports

The following jobs generated named coverage artifacts but did not submit them to any backend:

- `bazel:coverage:linux-amd64`
- `bazel:coverage:linux-arm64`
- `bazel:coverage:macos-amd64`
- `bazel:coverage:macos-arm64`

They now pass their `coverage-bazel-*.out` reports to the shared Datadog upload step.

**Impact:** Bazel coverage is visible in Datadog and can be compared with the legacy gotestsum coverage while the repository transitions toward Bazel-based testing.

#### Fix the GPU coverage submission

**Before:** `tests_gpu` attempted to upload coverage, but `gocovmerge` produced a zero-byte profile. Datadog rejected it because a Go coverprofile must begin with a `mode:` header. The upload was non-fatal, so the job remained green even though no report was accepted.

**Now:** If a merged profile is empty, the coverage helper adds the configured Go coverage mode header. Non-empty profiles are left unchanged.

**Impact:** The GPU job now submits a syntactically valid report and is recorded by Datadog instead of failing silently.

#### Fix Windows coverage submission

**Before:** `tests_windows-x64` generated coverage and merged the S3 cache correctly, but its upload attempted to execute `datadog-ci.exe`, which was unavailable in the build image. Direct PowerShell resolution of `datadog-ci` also failed, while the job remained green because uploads are non-fatal.

**Now:** A dedicated Invoke task resolves the platform-specific `datadog-ci` command with `shutil.which` and executes it through Python. This follows the same command-resolution pattern already used successfully by Windows JUnit uploads.

**Impact:** Windows coverage now reaches Datadog and contributes to the same commit-level aggregate as Linux and macOS coverage.

#### Preserve E2E coverage without Codecov coupling

**Before:** E2E profile conversion also read Codecov-specific metadata and uploaded to Codecov before Datadog processed the converted profiles.

**Now:** E2E coverage folders are converted directly into Go coverprofiles for Datadog. Conversion no longer depends on Codecov metadata.

**Impact:** Existing E2E coverage remains available while the conversion pipeline is simpler and backend-independent.

### Motivation

The repository already used Datadog Code Coverage, so maintaining Codecov in parallel added secrets, configuration, and CI work without providing a necessary capability.

At the same time, several jobs generated useful reports that Datadog never received, and the GPU and Windows upload paths failed silently. This change removes the redundant integration while making the Datadog submission path complete and verifiable.

### Describe how you validated your changes

- `dda inv invoke-unit-tests.run --tests=coverage,go --directory=tasks/unit_tests --no-buffer --verbosity=1`
- `dda inv linter.releasenote-unique-ids`
- `dda inv linter.full-gitlab-ci -t main --pre-push-linters --fail-fast --verbosity=2`
- The [pipeline](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/pipelines/132663591) passed.
- Datadog [confirmed](https://app.datadoghq.com/ci/code-coverage/github.com%2Fdatadog%2Fdatadog-agent/pull-requests/55278) all 11 expected non-E2E reports were ingested.

### Additional Notes

Windows Bazel jobs remain test-only because `rules_go 0.63.0` [does not](bazel-contrib/rules_go#4384 (comment)) reliably support Bazel coverage on Windows. `tests_windows-x64` remains the supported Windows coverage producer.

Co-authored-by: nikita-tkachenko-datadog <nikita.tkachenko@datadoghq.com>
Co-authored-by: ofek.lev <ofek.lev@datadoghq.com> 6aeb8ae