tooling: CI runs checkers.sh --ci <job>; the gate reads a table, not shell

improvise-st8q, improvise-tvte, from the #228 re-review at c1417359. The
maax parser still failed open. A bare checkers.sh inside a heredoc or a
folded run: value counted as every suite, and step and job if: were
ignored. Every round of parsing met another shell or YAML form, so the
parsing is gone.

checkers.sh holds a job-to-suites table (ci_suites), and each CI job
makes one call, `checkers.sh --ci <job>`. check-ci-graph.py counts a step
only when all of these hold: it sits inside steps: at step-key
indentation, its whole run: value is that call, the call names its own
job, and no if:, continue-on-error:, shell: or defaults: covers it. Every
other mention of scripts/checkers.sh is reported. A key with an inline
value owns deeper lines, and an open quote owns lines until it closes, so
heredocs, folds and quoted values are content, never structure.

There are 19 suite self-test cases and 7 rivals, each failing a case only
it can. The reviewer's heredoc, fold and if: attacks on the real ci.yml
now exit 1. checkers-test.sh gains five --ci cases. context/code/tooling.md
corrects two overstated claims ("--would-run anywhere is a usage error",
"fails closed").

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
       # assembly still exited 0 (improvise-w8ih). It guards the assemble step
       # below, so it fails under this job's name rather than another's.
       - name: The stamp gate refuses what it claims to
-        run: ./scripts/checkers.sh assemble-stamp
+        run: ./scripts/checkers.sh --ci build
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
@@ -248,7 +248,7 @@ jobs:
       # The guard above is only worth its line if its refusals are themselves
       # checked -- the step it replaces was green while asserting nothing.
       - name: The node test runner refuses what it claims to
-        run: ./scripts/checkers.sh node-test
+        run: ./scripts/checkers.sh --ci js
 
   kb:
     name: Knowledge base consistency
@@ -263,27 +263,12 @@ jobs:
         run: |
           nix shell nixpkgs#trealla --command tpl prolog-sessions/kb.pl \
             -g "(kb_consistent -> halt(0) ; (kb_report, halt(1)))"
-      # scripts/kb is the only thing that writes kb.pl, so its refusals are as
-      # load-bearing as kb_consistent itself. Without this the replacement
-      # writer could regress green -- the review that found the directive
-      # bypass also found that nothing ran this suite.
-      - name: The kb tool refuses what it claims to
-        run: nix shell nixpkgs#trealla --command ./scripts/checkers.sh kb
       # Every suite goes through scripts/checkers.sh, which pins a bash >= 5
-      # and scrubs the environment, so the shell and the variables a suite
-      # passes under here are the ones it passes under locally (improvise-f9qf).
-      - name: The checker runner refuses what it claims to
-        run: ./scripts/checkers.sh --self-test
-      # pr-watch is driven entirely from fixtures. The release preflight is the
-      # one guard whose absence is invisible until a tag is public and
-      # immutable. pr-reviews stands between a merge and an unread review, and
-      # was blind to inline comments for as long as it existed (improvise-xgra).
-      # fmt-workspaces is here because its own failure mode is the bug it
-      # exists for: a usage error wearing a formatting failure's exit code.
-      # bd-audit-ids is the dead-ID audit, whose recipe once read a bd that
-      # never ran as a clean audit (improvise-52eq).
-      - name: The remaining checkers refuse what they claim to
-        run: ./scripts/checkers.sh pr-watch release-preflight pr-reviews fmt-workspaces bd-audit-ids
+      # and scrubs the environment (improvise-f9qf). Which suites this job runs
+      # is the `kb` row of the CI table in checkers.sh, deliberately not listed
+      # here. check-ci-graph.py holds that table to `checkers.sh --list`.
+      - name: Every checker in scripts/ refuses what it claims to
+        run: nix shell nixpkgs#trealla --command ./scripts/checkers.sh --ci kb
 
   # ---------------------------------------------------------------------------
   # Lints the one crate the `test` job cannot reach.