test: the workflow text readers' remaining blind spots fail closed but loudly #43

From the independent reviews of the hash-pin tests (pull request #41) and the job reader (pull request #42). Neither case lets a workflow shape pass unchecked; both are rough edges of tests/python/test_workflows.py, which reads the workflows as text.

• jobs() splits the file on the exact line jobs:, so a jobs: # comment header raises an IndexError and the tests error out instead of failing with a message that names the cause.
• ANY_USES counts every spelling of a uses key against the strict pattern, but a flow-style step whose uses is not the first key (- { name: x, uses: actions/checkout@v4 }) matches neither, so such a step is not counted and its action is not checked. A cheap fix is to count any step line that contains { with uses inside it.

Fix both in one branch, with a fixture case each, when the file is next touched.