CI never runs the workflow-run cleanup test

Start in .github/workflows/ci.yaml by comparing the existing cask-pr-handoff and eks-smoke-scripts changes filters and jobs, then inspect require-checks-in-pr. Add coverage for the cleanup script, its test, and .github/fixtures/workflow-run-cleanup/**, including shellcheck and the test run, and wire the job into the required checks. Confirm with a deliberate regression that the new job fails.

🤖 Generated by the Agentic Engineer

Evidence

.github/scripts/delete-old-workflow-runs.test.sh exists and passes, but no CI job ever runs it.

.github/workflows/ci.yaml gates shell-script tests behind an explicit allow-list — one changes
path filter plus one job per script group. Two such groups exist today (cask-pr-handoff,
eks-smoke-scripts). The workflow-run cleanup script is in neither, and the only other reference to
it anywhere under .github/ is the delete-old-workflow-runs job name in maintenance.yaml, which
invokes the script in production but never its test.

Verified at head 4d8dbcb0 of #6685: grep -rn "delete-old-workflow-runs" .github/ returns exactly
one hit, in maintenance.yaml.

Impact

The nightly Maintenance workflow is the only thing that exercises this script, and it does so
directly against main. A regression is therefore discovered by the default branch going red — which
is precisely what happened in #6683 — rather than by a pull request failing.

That makes the test added in #6685 a one-time proof rather than a standing guard: nothing stops the
same class of failure returning.

Expected

A change to the cleanup script or its test runs that test in CI, and a failure blocks the pull
request instead of reaching main.

Acceptance criteria

• A changes path filter covering .github/scripts/delete-old-workflow-runs.sh,
  .github/scripts/delete-old-workflow-runs.test.sh, .github/fixtures/workflow-run-cleanup/**,
  and .github/workflows/ci.yaml.
• A job that shellchecks the script, its test, and its fixture gh, then runs the test — mirroring
  the existing eks-smoke-scripts job.
• The job is wired into require-checks-in-pr (both needs and job-results), as cask-pr-handoff
  already is, so it actually gates. A skipped path-filtered job is treated as a pass there today, so
  this does not block unrelated PRs.
• Proven by a deliberate regression: ablate the fix, confirm the new job fails.

Size

Small — configuration only, mirroring a pattern already present twice in the same file.