fix: run the whole test suite in CI, and repair the break it was hiding

[chubes4]

The problem

19 of 42 test files were never run by CI. Present in the repo, referenced nowhere in .github/workflows/shell.yml, executed only when someone remembered to by hand.

This is how #334 shipped 20/20 green while leaving main red:

1. fix: use environment for Kimaki lock port #334 changed how the Kimaki lock port reaches a systemd unit
2. It correctly updated tests/kimaki-multi-instance.sh to match
3. That test is one of the 19 → CI never ran it
4. Merged green. Test fails on main.

CI reported green over red. It only surfaced because I happened to run the full suite afterwards for an unrelated reason.

The break

#334 removed the --lock-port argument that bridge_render_systemd appended to ExecStart, moving it to an Environment= line. But the renderer only interpolates the env block its caller hands it.

So a guarantee the renderer enforced unconditionally became something every caller has to remember. A caller rendering with an env block that lacks the line silently drops the port, and the instance falls back to the default — two Kimaki instances then contend for one lock, which is precisely what multi-instance support exists to prevent.

Fixed at the layer that always owned it: the renderer re-asserts the line when KIMAKI_LOCK_PORT is set and the block doesn't already carry it.

The structural fix

tests/ci-coverage.sh — this is the part that matters.

A workflow that lists jobs by hand fails this way silently and permanently: the person adding a test is the same person who must remember to wire it, and nothing complains when they don't. The guard fails loudly instead, and carries an EXCLUDED list so that deliberately skipping a test is a visible decision in review rather than an omission.

It checks for the test name anywhere in the workflow rather than one exact invocation, so a matrix, a composite job, or a future restructure all still satisfy it. The claim is "CI knows about this file", not "CI runs it this particular way".

The 21 suites are wired as a matrix rather than 21 more hand-written jobs, so adding a test stays a one-line change. They run via bash because several of these files lack the executable bit — invoking ./tests/x.sh produces a Permission denied that reads exactly like a test failure. (That cost me a false "4 regressions" reading earlier today.)

Expect some of the newly-wired jobs to be informative

These have never run in CI. If any fail, that is the point — they are reporting real state that was previously invisible. Locally, everything passes except three environment-only failures that also fail on origin/main: this host has a real /usr/bin/kimaki that two tests resolve instead of their fixtures, and no studio CLI for a third.