tests: one run per commit, and nothing from apt

[JulienMartel]

What

Tests runs once per commit instead of twice, and asks apt for nothing.

• push: branches: ['**'] → branches: [main]
• sudo npm install -g bats replaces apt-get update && apt-get install -y bats shellcheck jq
• shellcheck and jq come from the ubuntu-latest image; jq gets its own version
  print so an image that dropped it fails loudly
• concurrency cancels a superseded run on a PR branch; main is exempt

Why

branches: ['**'] fired this workflow twice for every push to a PR branch —
once as push, once as pull_request — for one commit and one answer. Sixty
push runs against twenty-three PR runs over the last two weeks is most of what
that was. PRs keep the coverage they already had, through the trigger they
already had.

The install step asked apt for three tools and the image already shipped two of
them. apt-get update is also the step that hangs rather than fails when the
Azure mirrors go quiet — haus's check.yml has the long account.

jq is still named rather than assumed: the tier filter is a jq program and
the config layer is another, so an image that dropped it must fail as a missing
tool rather than turning every case into an error.

The family's four CI rules are now written down in the workshop's
docs/ci.md.

Verify

On this PR's run: one Tests run, not two. jq --version prints, shellcheck --version
prints, and bats test/ runs the whole suite under the npm bats.

After merge, push a commit to any branch that has no PR — no run should fire.
Open a PR from it — one run should fire.

Watch out

• 3/5 — the night shift reads CI status. factory tier and factory shift
  decide what may merge partly from a PR's checks. Those still exist: a PR gets
  its run from the pull_request trigger, which is unchanged. What disappears
  is the run on a branch with no PR open — which the shift never looks at,
  because it works from PRs. Worth confirming on the first night after this
  lands that tier 1 still sees green.

---

What the pre-PR assurance pass changed

A clean-context reviewer read this branch before it had a PR (AGENTS.md Step
2.5) and caught real defects, fixed in the commits above rather than carried:

• The concurrency block as first written was wrong. It put every push to
  main in one shared group with cancelling off, which is not what its own
  comment promised: a shared group serializes those runs, and GitHub cancels a
  pending run outright when a newer one joins the group. A merge followed
  closely by a bench ship lock bump would have left the middle commit with no
  run at all — the exact tick the rule protects. Only PR runs share a group now;
  everything else keys on the commit.
• Line 1 of the file still read "Verify factory on every push and PR" after
  line 46 stopped being true.
• Confirmed by the reviewer, not assumed: factory-tier's statusCheckRollup
  reads the head SHA's checks, which the unfiltered pull_request trigger still
  produces, and factory-shift only ever queries the default branch. Tier-1
  auto-merge is unaffected.
• Landing order: this body links docs/ci.md, which lands in the workshop
  PR of the same sweep. Merge that one first (or accept a link that resolves a
  few minutes later).

🤖 Generated with Claude Code

https://claude.ai/code/session_011wToFna2AmAJdZzJwqEKQs