✅ test(ci): allowlist the declarations that can neuter lint, not the spellings

The wiring gate enumerated evasions -- `if: false`, `continue-on-error`, `|| true`,
`&`, a leading `#` -- which is the unbounded side. `strategy.matrix: []` on the lint
job makes it produce zero instances, so nothing wired into it ever runs, and the gate
passed at exit 0 because nothing in it looked at `strategy`. Nine sibling shapes did
the same, including a step-level `shell: bash -c "echo skipped {0}"` that leaves the
invocation line byte-exact and hands it to `echo`.

State the invariant in the file -- a gate wired into lint must EXECUTE and its failure
must FAIL THE JOB, and any declaration that prevents either must be REPORTED -- and
enforce it from the finite side: closed key allowlists for the workflow root, the lint
job, and every lint step, plus exact permitted values for `shell` and for the step env
key set. An unrecognised declaration reds the gate and gets read by a human, whether or
not this file anticipated it.

Sixteen new self-test mutants, structural yq assignments only (METHOD-MUTHARNESS-02:
`sub()`'s replacement is a Go expansion template), each verified by message text. One
positive control keeps the allowlists from being merely restrictive: `shell: bash` is
stricter than the runner default and must stay legal. A step, or a step env, that is
not a map is reported rather than skipped -- an unenumerable key set would satisfy
every allowlist loop vacuously.

Author: konih