test: remove redundant unit tests (subsumed coverage + linter-enforced conventions)

[TomHennen]

Removes 30 redundant unit tests (240 lines, deletions only) across two rounds of review. Every removal was individually verified; the full bats suite is green (make bats: 0 failures). No production logic changed.

⚠️ Merge as a merge commit, not a squash. Several of the removed tests live inside SHA-pinned composite-action directories, so this PR converges its own self-ref pins in-PR (the two chore: converge self-ref pins commits). Squashing would re-orphan the intermediate nested pin (verify_release → verify). After merge, a routine tools/bump_action_pins.sh <main-sha> rolls the pins to the main SHA. See docs/e2e_testing.md.

Round 1 — subsumed by stronger existing coverage (14 tests)

• wrangle-shell-lint (6): per-rule "good.sh is not flagged" wrappers — the clean script: no violations reported test already asserts empty output, which excludes every rule id.
• wrangle-workflow-lint (1): the WWL003 good.yml exemption check — good.yml carries a justified continue-on-error, so the clean-workflow test exercises that path.
• verify (2): bnd-push-args shape (owned by the sign_metadata suite) and sourceable and callable (the arms are covered by the direct-exec tests; the sourced path by run_verify's fail-closed test).
• stop_commands_guard (1): preamble grep — enforced mechanically by WSL001/WSL002.
• log_findings (1): "exactly N lines" — the N×M over-emission path is guarded by the multi-location test.
• check_results (1): explicit :fail marker — default ≡ :fail is established by the policy-parsing tests.
• attest_{metadata_oci,provenance} (2): missing-metadata-root fail-closed — the guard is the first statement in the shared function and is covered centrally; each wrapper's wiring is proven by its real-engine happy-path test.

Round 2 — re-asserting linter-enforced conventions (16 tests)

Tests that grep a source file for a style property a custom linter now enforces over the whole tree in make test (CLAUDE.md: "Mechanical enforcement beats prose"). The linters' own suites (untouched) verify the rules fire on bad fixtures, and both linters pass clean on the tree.

• WSL002 set -f preamble (11): the go ^set -f greps + container/npm/python copies.
• WSL001 set -euo pipefail (2): the integration dispatch.sh / push_showcase_tag.sh preamble greps.
• WWL002 no ${{ inputs.* }} in a run: body (3): the go/npm/python composite-action interpolation scans.

Deliberately kept (looked redundant, verified not)

• Per-build-type path-rejection tests — wiring/integration tests proving each script routes its input through validate_path.sh; the central test only covers the lib in isolation.
• Real-engine attestation end-to-end tests — they drive the real wrangle-attest binary; the central equivalents use stubs (the repo's unit/integration boundary).
• "printf not echo" greps — forbid all echo, broader than WSL003's variable-only rule.
• env-passthrough plumbing greps — verify a specific input is wired through env:, which no linter checks.

🤖 Generated with Claude Code