Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/post_coverage_to_pr.yml:
- Line 22: Replace the mutable tag reference
"py-cov-action/python-coverage-comment-action@v3" in the workflow step with a
pinned commit SHA; update the uses field in
.github/workflows/post_coverage_to_pr.yml to
"py-cov-action/python-coverage-comment-action@<commit-sha>" (obtain the exact
SHA from the action repo's commit history) so the coverage action is
reproducible and immutable.
- Around line 14-17: Remove the unnecessary high-privilege permission by
deleting the "contents: write" entry from the workflow's permissions block; keep
"pull-requests: write" (needed for posting PR comments) and "actions: read"
intact so the workflow follows least privilege.

In @.github/workflows/pytest_coverage.yml:
- Line 21: The workflow currently references mutable action tags (e.g., "uses:
actions/checkout@v6" and the other uses lines at 24, 41, 49); replace those tag
references with the corresponding full commit SHAs for each action invocation so
the workflow is pinned to exact commits (search for the "uses:" lines such as
actions/checkout@v6, actions/setup-python@v4, actions/upload-artifact@v4 or
similar and swap the `@v`* tag for the action's full SHA from the upstream repo).
- Around line 15-17: The workflow's permissions block grants overly broad write
access by setting contents: write; change the permissions map so that
pull-requests remains write (for commenting) and contents is reduced to read to
follow least-privilege (update the permissions section replacing contents: write
with contents: read), ensuring the permissions keys (permissions, pull-requests,
contents) are preserved and only the contents permission level is lowered.

In `@tests/test_carrier_data_update_coordinator.py`:
- Around line 186-193: Replace the broad pytest.raises(Exception) with a
specific pytest.raises(ConfigEntryAuthFailed) in the test that patches
coordinator._async_full_refresh and calls coordinator._async_update_data; update
imports to include ConfigEntryAuthFailed if missing, and leave the existing
assertions (e.g., assert exc_info.type.__name__ == "ConfigEntryAuthFailed" and
assert coordinator.data_flush is True) intact so the test only catches the
intended authorization failure from coordinator._async_update_data.