Fix main: invert the reporter-session assertions, and widen the test trigger

[TennyZhuang]

main is red on 076cbf3. This fixes it.

What broke

production_config.test.ts asserted that the deploy workflow wires the
reporter-session keyring through the secret store. The cleanup merged in 076cbf3
removed exactly that wiring, so the test was describing a state we deliberately
left behind.

What this does

Inverts the assertions rather than deleting them — they are the record of what
was removed, and a deleted test cannot notice the wiring coming back. Since a suite
of doesNotMatch passes on an empty string, on a renamed file, and on a read that
returned nothing, it keeps a positive control anchoring it to a workflow that was
actually read.

Splits the environment binding into its own test. It outlived the case it lived
in: the environment is named for the retired feature but is not part of it. It is now
matched at job-key indentation rather than requiring jobs: → deploy: →
environment: to be adjacent — that adjacency is what broke, because a comment was
added above the line explaining why it must never be deleted. A test that goes red
when someone documents the thing it protects gets "fixed" by deleting the
documentation.

Both new cases were mutation-checked:

mutation	result
remove the environment: binding	binding test reds
re-add a keyring secret reference	absence test reds
restore	both green

Why it wasn't caught before the merge

The pull_request paths list enumerated the files this job reads in order to run.
That is not the same set as the files its tests make assertions about.
production_config.test.ts opens deploy-hands-server.yml; that path matched nothing
in the list; a PR touching only it ran no tests at all. Six green checks, none of them
this suite.

The push-to-main trigger has no paths filter — an earlier deliberate decision — and
that is what caught it, one merge too late. It is a net, not a gate.

The fix is a wildcard, not a longer list

The first version of this PR named deploy-hands-server.yml. That is still a derived
list — "which files do these tests assert on" — and a derivation that misses one is
silent in the direction of green, which is the same failure this entry exists to fix,
one level up. .github/workflows/** has nothing to miss.

Cost measured rather than assumed: the last eight runs of this job took 28–42s,
median 35. Thirty-five seconds on an unrelated workflow edit is affordable waste; a
guard that silently does not run is an unobservable failure. paths is a performance
optimisation and was being used as a correctness boundary.

(.github/workflows/worker-tests.yml is now subsumed by the wildcard and left in place
as documentation of why this job watches its own definition.)

Known residual, stated rather than papered over: this still does not cover a test
asserting on a file outside worker/** and .github/workflows/**. That is better
settled by a one-off repo-wide census than by a standing mechanism that misses silently.

"No test ran" and "every test passed" are the same green on a pull request page.

Verification

• full worker suite: 403 passed, 35 files
• workflow lint: exit 0
• mutation controls above