fix(devx): classify shard-attestation jobs by invocation, not by co-occurring substrings (#6589) (#6707)

`scanWorkflow` decided a job was an aggregate gate from
`text.includes(SCRIPT_BASENAME) && text.includes('--verify')` over the job's
JOINED `run:` text. Every attesting shard job already contains the basename
(its own `--emit` step), so the sole discriminator was a bare `--verify`
substring anywhere in any step — a `git rev-parse --verify` reclassified job
`test` as a gate and produced two complaints about gate properties a shard job
does not owe, pointing the reader at the #3622/#4928 contracts to break.
Documenting the collision in a `run:` comment re-armed it (#4890's shape).

The classification now asks whether the flag is an ARGUMENT of a command that
runs this script (`invokesScript`), over a small quote-aware lexer that joins
backslash-newline continuations, drops shell comments and splits at `; & | &&
||`. The same predicate replaces the two other substring tests in the same
function (`emitsHere`, "publishes an attestation that no gate counts").

Self-test: +3 workflow fixtures asserting a shard job that spells the flag for
an unrelated reason stays an attester (including one whose `run:` comment
spells the whole invocation), the `--emit` twin, and the positive limb — a
gate that no longer invokes the script stops being a gate. `scanWorkflow` now
reports `gateIds`/`attesterIds` so the classification is asserted directly, and
`fixture()` fails by name when its ci.yml anchor goes stale instead of silently
judging the pristine workflow.


Claude-Session: https://claude.ai/code/session_01F8q5J1MQyocgtNspb15fSn

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager