feat(tests): introduce real test suite (Vitest + Bats + pytest) — closes #88

[mvillmow]

Summary

Establish a real, executing test suite for ProjectProteus by introducing Vitest for the Dagger TypeScript module, Bats for the shell scripts, and pytest for pipeline-config integration tests, then wire all three into CI. This closes #88 by replacing the YAML-parse-only "tests" at _required.yml:107-150 with actual behavior assertions and by seeding regression coverage for the three load-bearing defects (#2 tag arithmetic, #15 payload contract, #82 config-not-consumed).

Changes

• Add dagger/src/index.test.ts with 5 Vitest tests (fully typed, no any)
• Add dagger/vitest.config.mts for ES-module Vitest config
• Update dagger/package.json with exact-pinned vitest@3.0.5
• Add tests/shell/{promote-image,dispatch-apply,check-symlinks}.bats
• Add tests/shell/stubs/{skopeo,curl} with sealed PATH isolation
• Add tests/integration/test_pipeline_configs.py with #82 xfail(strict=True)
• Update pixi.toml to include bats-core and pytest dependencies
• Add justfile recipes: test-unit, test-shell, test-integration, test-all
• Replace _required.yml unit-tests/integration-tests jobs with real runners
• Add shell-tests CI job for Bats tests
• Update CLAUDE.md with testing guidelines

Regression Seeds

• Fix build/promote tag arithmetic — build publishes :latest but promote expects :latest-staging #2 (tag arithmetic): Test in dagger/src/index.test.ts for correct tag refs
• cross-repo-dispatch.yml payload contract mismatch with AchaeanFleet notify-proteus.sh #15 (payload contract): Test in tests/shell/dispatch-apply.bats for client_payload.host
• [CRITICAL] §3: Pipeline YAML configs not consumed by any code #82 (config consumption): Xfail(strict=True) in tests/integration/test_pipeline_configs.py pins the contract
• [MAJOR] §3: build() publish: true default publishes to registry on every call #91 (publish opt-in): Test in dagger/src/index.test.ts verifies opt-in behavior

Verification

All tests pass locally:

• 5 Vitest unit tests (dagger/src/index.test.ts)
• 10 Bats shell-script tests (3 scripts × 2-4 tests each)
• 2 pytest integration tests, 1 xfailed under strict mode for [CRITICAL] §3: Pipeline YAML configs not consumed by any code #82 contract

Run all tests with: just test-all

Closes #88