ci: a runner that refuses unshare fails build-and-test and the JACK2 job, and a guard holds it (#107)

[linuxnow]

In .github/workflows/ci.yml the else branch taken when the runner refuses unshare printed a ::warning and, in build-and-test, ran make sabotage without the LV2 guard, so the comment "a run that skipped them fails here" held for the then-branch only: a run that skipped the JACK and LV2 scenarios went green. The JACK2 job had the same shape.

• Both else branches print an ::error and exit 1.
• tests/ci_guards.py reads every workflow: after each if unshare ...; then there is an else, and it exits 1. It first proves it sees a planted warn-only else and a planted missing else, and passes a planted one that exits 1; then it scans the tree. Red on main as it stood (lines 96 and 160), green here. make test runs it as check-ci-guards (172 ok on the desk).
• make sabotage gains "a runner that refuses unshare passes build-and-test with a warning" (one branch back to a warning), with a ciguards kind that copies the workflows into the scratch tree, and it is caught:
  ok sabotage caught: a runner that refuses unshare passes build-and-test with a warning -> every if unshare in the workflows fails red
  The full run on the desk with the worker environment: 181 caught, the one survivor is sabotage: "a nice the daemon could not apply is not logged" survives where the nice applies #116 (the unapplied nice, pre-existing on main). Six JACK controls did not run in that pass because the JACK fixtures were not built in the lane yet; the rerun with them built is in the first comment.

The then-branch is what CI's runners take today, so this job and the JACK2 job must stay green here: that is the round trip for a change whose only effect is on a runner that cannot run the scenarios.

Codes: none added, none removed.

Closes #107

[linuxnow]

Sabotage rerun on the desk with the JACK fixtures built (tests/stress.clap, tests/jack_levels, tests/host_scenarios), the full worker environment and a one-bundle LV2 world, as main's CI ran it before #117: 187 caught, 0 controls failed, 0 skipped, the one survivor is #116 (the unapplied nice, pre-existing on main). The new entry: ok sabotage caught: a runner that refuses unshare passes build-and-test with a warning -> every if unshare in the workflows fails red. The six JACK controls of the first pass had no output because those fixtures were not built in the lane yet, not a daemon fault.