Exercise adversarial JS runner rejection cases

[hzw0813]

Summary

• make every unsafe Jest/Vitest command-shape regression use a script name that ProofDiff actually classifies as a test check
• assert each fixture is discovered as js:test:test before asking the targeted-runner parser to reject it
• cover unsupported flags, command substitution/chaining, unsupported wrappers, excessive/duplicate environment assignments, and non-ASCII whitespace independently

Why

The previous aggregate regression put most adversarial commands under names such as test:substitution, test:chain, and test:dotenv. discoverChecks() intentionally recognizes only the bounded names test, test:unit, test:ci, test:all, and check:test, so those entries were never passed to recognizedRunnerScript() at all. The test still passed because the one recognized test entry (jest --coverage) was opaque, creating a false sense of coverage over the other rejection boundaries.

This change gives each adversarial command its own fixture under the recognized test name and explicitly asserts discovery reached that check before asserting targeted runner inference stays empty. It also locks in the post-CR/LF parser boundary for non-ASCII whitespace.

Verification

• full npm test passed with the corrected regression matrix
• final branch diff contains only tests/js-runners.test.ts; temporary updater files were removed