test(signal): pin the ci-red clearer, and prove each assertion goes red

35 tests over scripts/ci/clear_stale_ci_red.py, in their own file: the reader's
and the writer's suites are both edited by open PR #1240, and a third subject
does not belong in a merge conflict.

EVERY BEHAVIOURAL ASSERTION WAS MUTATION-TESTED, because this repository's rule
is that a test which would pass either way is not evidence. Eight mutations of
the script, each reverted after:

  neutral/skipped counted as success        -> 2 failed
  queue_evidence ignoring `since`           -> 2 failed
  newest_by_name ignoring the unsettled run -> 2 failed
  head_seen_at trusting the git date alone  -> 1 failed
  the dry-run default removed               -> 1 failed
  an empty page set read as an absence      -> 1 failed
  the pre-write fingerprint check dropped   -> 1 failed
  the circuit breaker removed               -> 1 failed

Restored, 35 passed. test_the_decision_can_produce_a_different_answer is the
file-wide control: it drives the real functions with mutated copies of one
baseline and requires the untouched baseline to come back CLEAR on both axes, so
neither arm can be passing because both branches return the same thing.

test_the_script_can_only_remove_and_never_add asks the PARSED source, not the
text. The script discusses --add-label in prose -- why a label-timestamp
compare-and-swap cannot detect a re-application -- and a substring search cannot
tell that sentence from an argv.

Registered on the tooling tier in tests/tooling_manifest.txt beside
test_ci_red_reader.py and test_failure_signal.py: the subject is the CI harness,
not the engine.

Verified: ruff check . and ruff format --check . clean tree-wide (1314 files),
mypy clean on both new files, and the partition gate green
(test_tooling_partition, test_ci_tooling_gate, test_ci_red_reader,
test_failure_signal -- 82 passed).

Context only, not claimed and not closed: BACKLOG #1385 and #1403.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: wshallwshall