fix(quality): allowlist the check-workflows assert reduction from #14497 fail-closed refactor

[Junior-HJ]

Summary

• Adds one allowlist entry in config/quality/test-masking-allowlist.json so the check:test-masking gate stops flagging tests/unit/build/check-workflows.test.ts: asserts 73 -> 67 (REMOCAO de 6).
• Cause is commit 90f81d421f (fix(ci): fail closed on incomplete workflow audits #14497, fix(ci): fail closed on incomplete workflow audits), already on release/v3.8.52, authored by the maintainer. That commit migrated parseZizmorOutput from graceful-fallback (count=0 for empty/invalid/unknown output) to fail-closed (assert.throws) and replaced the quality.yml advisory-build pinning block with the admission-delegation contract. The net-assert reduction follows that legitimate refactor — not masking. Exact case the allowlist is designed for (verified-legitimate refactor, NOT weakening to go green).
• The entry self-prunes: once v3.8.52 merges to main, the merge-base reflects the reduced state and the signal no longer fires.
• Only the reduction signal is exempted. Tautology / skip / deletion signals still fire for this file.

⚠️ base-red inherited: #15306

Related Issues

• Partially addresses 🔴 Release branch not green: release/v3.8.52 #15306 (the two check:test-masking / ci.yml:pr-test-policy failures on check-workflows.test.ts).
• check:agent-skills-sync in 🔴 Release branch not green: release/v3.8.52 #15306 is covered by docs(skills): regenerate the provider endpoints reference #15454 (regenerates skills/omni-providers/references/endpoints.md) — not duplicated here.

Validation

• Change type: other (quality config + changelog fragment only)
• node scripts/check/check-test-masking.mjs with GITHUB_BASE_SHA=origin/main no longer reports check-workflows.test.ts (reduction exempted by the new entry)
• config/quality/test-masking-allowlist.json parses as valid JSON
• npm run lint (exit 0)
• node --import tsx/esm --test tests/unit/build/check-workflows.test.ts: 32/34 on Windows — the 2 failures are the pre-existing CRLF regex bug in the test's workflow-YAML asserts (file untouched by this PR; passes on Linux CI). Non-goal of this PR.
• No production code changed

Tests Added Or Updated

• None. This is a quality-gate config entry + changelog fragment. The gate's own behavior is what changed and it is validated above.

Coverage Notes

• Not applicable. No production code changes.

Reviewer Notes

• Precedent: this allowlist already holds many entries of the same class (e.g. tests/unit/chatcore-sanitization.test.ts v3.8.43 fix(translator): strip orphaned tool results across request formats #5805, tests/unit/combo-context-window-filter.test.ts v3.8.44 fix(combo): prefer known context capacity over unknown #6088).
• Scope: 2 files (allowlist entry + changelog fragment). Nothing else.
• Out of scope on purpose: check:agent-skills-sync (docs(skills): regenerate the provider endpoints reference #15454), audit.test.ts flaky CI checkpoint (passes 8/8 locally), suite/runner timeouts and SQLITE_CANTOPEN (infra, not contributor-fixable).