test(ci-shard): two guards that misreport their own cause #778

Two findings on tests/ci-shard.test.sh, surfaced by the /premerge run on #768 and dropped by the issue-filer's max_new cap (both SUGGESTION tier, so no halt — but they were recorded nowhere else).

1. s8_script's FATAL exit 2 only kills a subshell at three of its four call sites (tests/ci-shard.test.sh:205)

S8 calls it at top level (~246), where exit 2 correctly aborts the fixture. S9_PY (~288), S9_SUB (~307) and S8_SYN (~321) call it inside VAR="$( … )" command substitutions. If @@S8-INVOCATIONS@@ moves or the invocation file is empty, exit 2 terminates only the substitution subshell; the FATAL text goes to stderr, the variable is set empty, and the row that follows reports routing failures instead — sending a maintainer to the harness rather than to the marker that actually broke, which is exactly the confusion the helper's own comment says it exists to prevent.

2. S10/S12 carry the invocations-vs-deduplicated asymmetry that #768 fixed in the workflow

They count --- RUN lines (invocations) against the de-duplicated plan length from tests/ci-job-fixtures.sh. #768 fixed the same asymmetry in the three run_one harnesses in .github/workflows/test.yml (count distinct fixtures, not invocations); these two rows still compare the two different things, so a job that invokes one fixture twice would red them while the shipped guard it mirrors now passes correctly.

Reported by the agent that fixed the workflow half, as out-of-scope for its single file.

Related: PR #768