refactor(scripts): move CI helpers out of scripts/ci-guards/

The 'Regression guards' loop step in ci.yml runs:
    for g in scripts/ci-guards/*.sh; do bash "$g"; done

Per the directory's own contract (scripts/ci-guards/README.md), every
script there MUST be runnable bare with no args / no env. Three files
violated that contract — they're helpers consumed by specific CI job
steps with arguments, not regression guards. They were misplaced.

Moved (git mv):
  scripts/ci-guards/vendor-e2e-skip-check.sh         → scripts/
  scripts/ci-guards/vendor-e2e-skip-allowlist.txt    → scripts/
  scripts/ci-guards/coverage-pr-comment.sh           → scripts/

Updated ci.yml call sites:
  - deploy-vendor-e2e job: bash scripts/vendor-e2e-skip-check.sh $LOG
  - go-build-and-test job: bash scripts/coverage-pr-comment.sh

Tightened scripts/vendor-e2e-skip-check.sh arg parse from a silent
default ('LOG=${1:-test-output.log}') to a mandatory-arg form
('LOG=${1:?usage: ...}') so misuse fails loud at parse time rather
than at the missing-file check.

Updated scripts/ci-guards/README.md contract to spell out the
guard-vs-helper distinction explicitly; lists current helpers under
scripts/ for future-author guidance.

Verified locally: 'for g in scripts/ci-guards/*.sh; do bash $g; done'
returns clean (22 guards pass) on HEAD post-move.

Closes the regression-guards-loop failure that surfaced in CI run
25192163943 (job 73864471346 'Frontend Build').

scripts/vendor-e2e-skip-check.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# scripts/vendor-e2e-skip-check.sh
+#
+# Counts `^--- SKIP:` lines in the vendor-e2e test output and fails
+# the build if any test skipped that's NOT in the allowlist at
+# scripts/vendor-e2e-skip-allowlist.txt.
+#
+# Per ci-pipeline-cleanup bundle Phase 5 / frozen decision 0.6.
+# requireSidecar() in deploy/test/vendor_e2e_helpers.go uses
+# t.Skipf() when a sidecar isn't reachable. The collapsed
+# deploy-vendor-e2e job brings up all 11 sidecars at once — if
+# one fails to start, the affected tests skip silently. This
+# guard catches that.
+#
+# Lives in scripts/ (not scripts/ci-guards/) because it's a
+# helper that consumes a test-output log produced by a specific
+# CI step — not a regression guard runnable bare. The
+# scripts/ci-guards/ contract requires bare-callable, no-arg
+# scripts. See scripts/ci-guards/README.md.
+#
+# Usage: bash scripts/vendor-e2e-skip-check.sh <test-output.log>
+
+set -e
+
+# Mandatory arg — fail loud at parse time rather than when the file
+# is missing (avoids the silent-default footgun).
+LOG="${1:?usage: $0 <test-output.log>}"
+ALLOWLIST="scripts/vendor-e2e-skip-allowlist.txt"
+
+if [ ! -f "$LOG" ]; then
+  echo "::error::test output log not found: $LOG"
+  exit 1
+fi
+
+if [ ! -f "$ALLOWLIST" ]; then
+  echo "::error::skip allowlist not found: $ALLOWLIST"
+  exit 1
+fi
+
+# Build the set of allowed-skip test names (strip comments + blanks).
+allowed=$(grep -vE '^\s*(#|$)' "$ALLOWLIST" | sort -u)
+allowed_count=$(echo "$allowed" | grep -c .)
+
+# Extract skipped test names from `--- SKIP: TestName (0.00s)` style lines.
+skipped=$(grep -E '^--- SKIP: ' "$LOG" | awk '{print $3}' | sort -u || true)
+skipped_count=$(echo "$skipped" | grep -c . || true)
+
+echo "Vendor-e2e skip-check:"
+echo "  allowlist size: $allowed_count"
+echo "  observed skips: $skipped_count"
+
+# Find skips not in allowlist.
+unexpected=$(comm -23 <(echo "$skipped") <(echo "$allowed") || true)
+if [ -n "$unexpected" ]; then
+  echo "::error::Unexpected test skips — a sidecar likely failed to start"
+  echo "Unexpected skipped tests (not in $ALLOWLIST):"
+  echo "$unexpected" | sed 's/^/  - /'
+  echo ""
+  echo "Either:"
+  echo "  (a) Fix the sidecar / network / docker-compose issue causing the skip, OR"
+  echo "  (b) If the skip is legitimate (e.g., a new Windows-only test added),"
+  echo "      add the test name to $ALLOWLIST with a one-line justification comment."
+  exit 1
+fi
+
+# Also flag skips beyond the allowlist count (defensive — comm -23 catches
+# this already but the explicit count check makes the error message clearer).
+if [ "$skipped_count" -gt "$allowed_count" ]; then
+  echo "::error::Skip count $skipped_count exceeds allowlist size $allowed_count"
+  exit 1
+fi
+
+echo "vendor-e2e-skip-check: clean ($skipped_count skips ≤ $allowed_count allowed)."