ci: separate object storage integration from coverage UT

[gouhongshen]

Summary

• remove real object-storage credentials from the all-package UT coverage job
• make coverage eligibility depend only on pull-request trust, not cloud secrets
• add a reusable provider-isolated Aliyun OSS / Tencent COS integration workflow
• allow trusted callers to test an exact MatrixOne PR repository and commit

Root cause

The coverage job exported TEST_S3FS_ALIYUN and TEST_S3FS_QCLOUD before running go test -short ./.... MatrixOne's fileservice tests discovered those ambient variables and executed real cloud contract tests inside the unit-test process. A TCP timeout on the Tencent TKE runner's cross-cloud route to Aliyun OSS therefore failed an unrelated PR coverage check.

The failed run reached no HTTP response: DNS resolved, but TCP connection establishment to the Aliyun endpoint timed out. Its rerun passed on a different ephemeral runner at the same commit, which rules out credentials and MatrixOne SDK behavior as the direct cause.

Changes

• coverage UT no longer declares, checks, or exports object-storage credentials
• stale generic S3 secret exports, which have no MatrixOne Go test consumers, are removed with the same boundary
• the external integration workflow runs Aliyun and QCloud independently with fail-fast: false
• each provider receives only its own test specification and explicitly enables MatrixOne's external test tier
• optional checkout repository/ref inputs let a trusted MatrixOne PR caller test the exact head commit before merge; scheduled callers default to their current repository revision

Rollout

Merge this PR before the paired MatrixOne PR. The coverage change is independently compatible with current MatrixOne: without TEST_S3FS_*, the existing fileservice suite uses local disk only. After the caller lands, relevant fileservice/dependency PRs run real provider integration before merge, while a daily run continues detecting provider or network drift.

Related issue: matrixorigin/matrixone#26541.

Validation

• actionlint v1.7.7 on both changed CI workflows and the paired MatrixOne caller; known custom-runner and existing job.workflow_* false positives excluded
• git diff --check