Resolve the CI-script exceptions outside the deploy pipeline

[anth-volk]

Fixes #3893

Summary

Phase 1 step 1.7, part 1. Stacked on #3890; the deploy-pipeline part is the next PR in the stack.

• alembic-v1-check.yml: the folded pytest command is now one line.
• pr.yml: apt-get update and the Redis install are now two single-line steps.
• sync-cloud-run-secrets.yml: the master-only gate is a new tested script, require_git_ref.sh. The existing workflow test now checks that it runs before authentication.
• cleanup_cloud_run_images.sh gets tests with a fake gcloud: keep the newest N, dry run, within the limit, and failed deletes.
• deploy_observability_collector.sh: the GITHUB_OUTPUT writes are grouped (shellcheck SC2129). Behaviour is unchanged.
• Baselines:
  • The multi-line baseline drops from 10 to 7; the rest are in the deploy pipeline.
  • The untested-script and shellcheck baselines are now empty, so api.ci.workflow-scripts-tested and api.ci.shell-scripts-pass-shellcheck move from ratcheted to enforced.
• Tool: once a CI rule is enforced, the ci-scripts guard still attributes its findings to that rule rather than [registry]. scripts/rules/ stays byte-identical with sim's copy.

Testing

• New tests in tests/unit/test_workflow_guard_scripts.py: 6 pass. The related workflow and deploy-script tests pass too (139).
• python scripts/run_quality_guards.py: all three guards pass. guard --base-ref rules-followups passes.
• Before the baselines were trimmed, the guard flagged each fixed entry as stale, which shows the ratchet working.
• python -m unittest discover -s scripts/rules/tests -t .: 75 pass.
• ruff format/ruff check and actionlint are clean. All scripts pass shellcheck.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.58%. Comparing base (91b279d) to head (197b28e).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #3895       +/-   ##
===========================================
+ Coverage   45.25%   87.58%   +42.33%     
===========================================
  Files         183      198       +15     
  Lines       11085    12223     +1138     
  Branches     1907     2161      +254     
===========================================
+ Hits         5016    10706     +5690     
+ Misses       5647      921     -4726     
- Partials      422      596      +174     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.