ci: replace silent safety net with hard validation in pr-build.yaml

[stutiibm]

The 'Emit per-UBI outputs' step previously had a safety net that silently filled empty SCRIPT_UBI* slots by reading '# Tested on' directly from changed .sh files. This masked two real misconfigurations that would only surface later when Currency-build ran and silently produced an incomplete build (e.g. only UBI9, skipping UBI10).

Replace the silent filler with a hard-stop validator that enforces two mandatory rules on every changed .sh file:

1. '# Tested on' header is mandatory. A script missing this header now fails the PR immediately with a clear error message instead of being silently skipped.

2. The UBI slot for each changed script must already be populated by read_buildinfo.sh via the version block in build_info.json. An empty slot indicates a version block key mismatch (e.g. key "1.5.4" vs VERSION="v1.5.4") that would cause Currency-build to fall back to the "*" wildcard and skip the affected UBI variant.

If either rule is violated the step exits with code 1, blocking the PR merge. Currency-build has no equivalent safety net, so catching these errors at PR time is the correct enforcement point.

Checklist

• Have you checked and followed all the points mention in the CONTRIBUTING.MD
• Have you validated script on UBI 9 container
• Did you run the script(s) on fresh container with set -e option enabled and observe success ?
• Did you have Legal approvals for patch files ?