CUST-WP-0060 test coverage: validate_work_records suite + CI wiring + C-31 comment fix

Critical review of CUST-WP-0060 (T03-T06) found: shipped mechanism proven
only by manual/live-repo runs, no repeatable test suite; tests/ never
wired to CI at all (pre-existing gap, not introduced here).

- tests/test_validate_work_records.py: 30 tests against the live canon
  registry/schemas — classify() incl. all grandfathered legacy id
  schemes, per-kind schema gates (intake open/closed/promoted, decision
  prepared/resolved, engagement prepared), multi-doc yaml handling,
  malformed-yaml-only-errors-if-id-registered, main() end-to-end via
  subprocess (exit codes, template placeholders, --strict escalation,
  terminal-record historical grace incl. the boundary case that grace
  must NOT mask real enum violations), and the jsonschema-unavailable
  fallback path (the exact failure mode that broke the first Forgejo
  CI run before the runner-substrate fix)
- tools/validate_work_records.py: docstring said 'authoritative detector
  is fix-consistency C-25' — wrong, it landed as C-31 (C-25..C-30 were
  already taken); comment now correct
- .forgejo/workflows/python-tests.yaml: wires tests/ to CI for the first
  time in this repo (apt python3/pytest/jsonschema/yaml on the
  node:20-bookworm substrate, same pattern as work-records.yaml)
- tests/test_scan_workstream_terminology.py: found one pre-existing,
  unrelated failure while establishing the CI-representative baseline
  (agentic-resources allowlist entry no longer sets exclude_repo — a
  policy question, not a bug this task should resolve silently); marked
  xfail(strict=True) with the finding recorded so CI has a clean signal
  and a silent 'fix' doesn't go unnoticed either

Local verification with apt-sourced deps (jsonschema 4.10.3, matching the
CI runner's package source, not just pip): 34 passed, 1 known xfailed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/validate_work_records.py

@@ -12,7 +12,7 @@ are already parsed authoritatively by state-hub).
 
 Blocks with an id-like string that matches *no* registered pattern produce
 a warning (CI-level sidetrack hint; the authoritative detector is
-fix-consistency C-25).
+fix-consistency C-31).
 
 Usage:
     validate_work_records.py [--repo PATH] [--canon PATH] [--strict]