Resolve the CI-script exceptions outside the deploy pipeline

[anth-volk]

Fixes #3893

Summary

Phase 1 step 1.7, part 1. Stacked on #3890; the deploy-pipeline part is the next PR in the stack.

• alembic-v1-check.yml: the folded pytest command is now one line.
• pr.yml: apt-get update and the Redis install are now two single-line steps.
• sync-cloud-run-secrets.yml: the master-only gate is a new tested script, require_git_ref.sh. The existing workflow test now checks that it runs before authentication.
• cleanup_cloud_run_images.sh gets tests with a fake gcloud: keep the newest N, dry run, within the limit, and failed deletes.
• deploy_observability_collector.sh: the GITHUB_OUTPUT writes are grouped (shellcheck SC2129). Behaviour is unchanged.
• Baselines:
  • The multi-line baseline drops from 10 to 7; the rest are in the deploy pipeline.
  • The untested-script and shellcheck baselines are now empty, so api.ci.workflow-scripts-tested and api.ci.shell-scripts-pass-shellcheck move from ratcheted to enforced.
• Tool: once a CI rule is enforced, the ci-scripts guard still attributes its findings to that rule rather than [registry]. scripts/rules/ stays byte-identical with sim's copy.

Testing

• New tests in tests/unit/test_workflow_guard_scripts.py: 6 pass. The related workflow and deploy-script tests pass too (139).
• python scripts/run_quality_guards.py: all three guards pass. guard --base-ref rules-followups passes.
• Before the baselines were trimmed, the guard flagged each fixed entry as stale, which shows the ratchet working.
• python -m unittest discover -s scripts/rules/tests -t .: 75 pass.
• ruff format/ruff check and actionlint are clean. All scripts pass shellcheck.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.56%. Comparing base (344702f) to head (95427f1).

Additional details and impacted files

@@               Coverage Diff                @@
##           rules-followups    #3895   +/-   ##
================================================
  Coverage            87.56%   87.56%           
================================================
  Files                  198      198           
  Lines                12211    12211           
  Branches              2159     2159           
================================================
  Hits                 10692    10692           
  Misses                 922      922           
  Partials               597      597           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.