refactor(scripts): move CI helpers out of scripts/ci-guards/

The 'Regression guards' loop step in ci.yml runs:
    for g in scripts/ci-guards/*.sh; do bash "$g"; done

Per the directory's own contract (scripts/ci-guards/README.md), every
script there MUST be runnable bare with no args / no env. Three files
violated that contract — they're helpers consumed by specific CI job
steps with arguments, not regression guards. They were misplaced.

Moved (git mv):
  scripts/ci-guards/vendor-e2e-skip-check.sh         → scripts/
  scripts/ci-guards/vendor-e2e-skip-allowlist.txt    → scripts/
  scripts/ci-guards/coverage-pr-comment.sh           → scripts/

Updated ci.yml call sites:
  - deploy-vendor-e2e job: bash scripts/vendor-e2e-skip-check.sh $LOG
  - go-build-and-test job: bash scripts/coverage-pr-comment.sh

Tightened scripts/vendor-e2e-skip-check.sh arg parse from a silent
default ('LOG=${1:-test-output.log}') to a mandatory-arg form
('LOG=${1:?usage: ...}') so misuse fails loud at parse time rather
than at the missing-file check.

Updated scripts/ci-guards/README.md contract to spell out the
guard-vs-helper distinction explicitly; lists current helpers under
scripts/ for future-author guidance.

Verified locally: 'for g in scripts/ci-guards/*.sh; do bash $g; done'
returns clean (22 guards pass) on HEAD post-move.

Closes the regression-guards-loop failure that surfaced in CI run
25192163943 (job 73864471346 'Frontend Build').

.github/workflows/ci.yml

@@ -133,7 +133,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-        run: bash scripts/ci-guards/coverage-pr-comment.sh
+        run: bash scripts/coverage-pr-comment.sh
 
       # Bundle P / Strengthening #6 — QA-doc drift guards. Forces every PR
       # that adds a Part to docs/testing-guide.md OR a seed row to
@@ -327,7 +327,7 @@ jobs:
   # placeholders). Collapsed to one job that brings up all 11 sidecars
   # at once and runs the full VendorEdge_ test set.
   #
-  # Skip-detection guard (scripts/ci-guards/vendor-e2e-skip-check.sh)
+  # Skip-detection guard (scripts/vendor-e2e-skip-check.sh)
   # enforces that no test SKIPs except the documented allowlist
   # (windows-iis-requiring tests on Linux). If a sidecar fails to come
   # up, requireSidecar() in deploy/test/vendor_e2e_helpers.go calls
@@ -387,7 +387,7 @@ jobs:
         # lines in the test output and fails the build if it exceeds the
         # allowlist (windows-iis-requiring tests; legitimately skipped
         # on Linux per Phase 6 / frozen decision 0.5).
-        run: bash scripts/ci-guards/vendor-e2e-skip-check.sh test-output.log
+        run: bash scripts/vendor-e2e-skip-check.sh test-output.log
 
       - name: Tear down sidecars
         if: always()