Fix the split guard reporting a cached PASS in CI

[tom-snyder]

Summary

main went red on the artifact-split negative control — and it went red for the right reason. The control caught TestSplit reporting ok (cached) while never looking at the injected internal/dast import. A guard that can replay a stale PASS is precisely the failure mode the control exists to detect, so this is the mechanism working, not a flaky check.

Cause

TestSplit's verdict comes from the output of an external go list -deps process, which Go's test-result cache does not track. With the build cache restored by setup-go's cache: true, go test can serve a previous PASS for a package whose import graph has since changed.

Fix

1. -count=1 on all three TestSplit invocations, plus a prominent warning in split_test.go's doc comment so the trap isn't reintroduced by someone invoking it another way. This alone removes the dependence on cache behaviour.

2. The negative control now asserts the right failure, not just any failure. A nonzero exit proves only that something went wrong — a compile error would produce one too, and would let a broken guard masquerade as a working one. It now requires the output to name internal/dast/ciprobe, and explicitly fails if it ever sees (cached) again:

::error::Go replayed a cached result instead of running the test. -count=1 is not taking effect.

That turns any recurrence into a self-describing failure instead of a silent green.

Honest note on evidence

I could not reproduce the stale PASS locally. Locally the package hash changes when the file is added, so the cache correctly misses and the guard fails as intended with or without -count=1. The stale result appeared only in CI against a restored cache.

Rather than guess at the precise cache-key mechanism, -count=1 removes the question entirely, and the (cached) assertion makes any recurrence loud. I'd rather ship a fix that is robust to a mechanism I haven't fully characterised than a fix that depends on my having characterised it correctly.

Testing

# violation injected
go test -count=1 ./cmd/anvil -run TestSplit   -> FAIL, names internal/dast/probe
# after revert
go test -count=1 ./cmd/anvil -run TestSplit   -> ok
gofmt -l .                                     -> clean

The real test is this PR's own CI run, which exercises the negative control against a warm cache — the exact condition that failed on main.