test: make the job reader fail on a header it does not recognise

[cristiangirlea]

Closes #36

What changed

• tests/python/test_workflows.py
  • jobs(): a job header is now its key two spaces in, quoted or not, with nothing after the colon but a comment ( php: # matrix and "php": are jobs). Its docstring says why the count below exists.
  • test_the_job_reader_sees_every_job: per workflow, the number of jobs read equals the number of runs-on: lines in the file, so a header the reader still does not know fails the test instead of hiding the job from the per-job checks (checkout before compose, no local action, the runner label).
  • test_the_job_reader_on_the_headers_it_must_tell_apart: an inline fixture with a commented header, a double- and a single-quoted key, a comment between jobs, a mismatched-quote header and an anchored header the reader does not know (the count is what catches them), and a top-level key after the jobs whose runs-on: line is counted on purpose, so the guard fails closed.
• docs/testing.md: the Python worker count is 156 (154 on main).

Tests that ran

• Red check: the new count against the old reader (the test file as of 8cd6cb8) on tests.yml, each edit alone and reverted: a commented first-job header ( php: # matrix) and a quoted one ( "php":) both left the reader with ['mcp', 'deterministic'] against three runs-on: lines; an anchored header ( deterministic: &gate) left ['php', 'mcp'] against three. With the new reader the commented and quoted headers pass, and the anchored one fails test_the_job_reader_sees_every_job (2 != 3) as well as the per-job runner test.
• python -m unittest tests.python.test_workflows: 12 tests OK on the host.
• docker compose -f docker/compose.yaml run --rm --no-deps python-tests: 156 tests OK on this commit (a7ec490). The PHP, integration and MCP layers run in CI on this PR; only test code and docs changed.

Independent review

delivery-reviewer on the first draft of this commit: nothing blocking. Folded into the one commit before pushing: the reader's docstring now says what an unrecognised header does to a first job and to a later one; the runs-on: count lives in one helper, runs_on_lines(), used by the guard and by the fixture; the fixture asserts what matters (the jobs read, the count, and that the two disagree) instead of pinning where a missed job's lines end up; a mismatched-quote header pins the backreference.

Left as they are, all on main before this branch and failing closed: jobs() raises on a jobs: # comment line instead of failing with a message; the pin test's spelling count misses a flow-style step whose uses is not the first key. Filed as one issue (linked below) since both are the text readers' remaining blind spots.

Follow-up issue for the readers' remaining blind spots: #43.