test(pm-agent): a committed negative-path probe for the worker's input guards

pm-worker's command is pinned by admission with no args, so everything a caller could
influence arrives in the environment — and the guards at the top of that script are what
stand between an injected variable and a clone from the wrong host or a push to the
wrong ref. Nothing exercised them, which makes them a claim rather than a control.

probe-validation.sh asserts 17 refusals, each on BOTH a non-zero exit and the specific
message, so a guard that stopped firing cannot pass by failing somewhere else. It covers
a redirected git host, a real and reachable WRONG one (the egress policy permits tcp/443,
so that case is not hypothetical), the right host with a smuggled path, 'main' and five
other bad branch shapes, a malformed owner/repo, a bad mode, a bad issue number, and each
missing credential. build-image.sh runs it inside the built image too.

Writing it found three things:
 - the PM_BRANCH != main guard is unreachable while the pattern check above it holds, so
   the comment claiming it as the defence was wrong about which line does the work. Kept
   as an assertion independent of the regex; the comment now says so.
 - the EXIT trap ended in a failing test, which under set -e can replace the script's
   real exit code with that failure.
 - a provenance LOG LINE read a file through a redirect that set -o pipefail would have
   turned into a dead worker if the file were absent.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

platform/pm-agent/README.md

@@ -151,7 +151,9 @@ nobody enumerated — on the sibling policy that was `initContainers` (measured:
 compliant `containers[0]` and a privileged init container was **admitted**, pass 3 fail 0),
 then `ephemeralContainers`, then `env`, then `envFrom`. All of them are closed here from the
 start, and `platform/kyverno/tests/pm-agent/` proves each refusal offline: **28 assertions,
-28 passing** under the pinned `kyverno` CLI.
+28 passing** under the pinned `kyverno` CLI. The worker's own input guards have their own
+offline probe — `infra/agent/probe-validation.sh`, **17 refusals** — because a guard nothing
+exercises is a claim rather than a control.
 
 > The policy is applied by `platform-config/kustomization.yaml`, and it has to be: adding a
 > ClusterPolicy only to `platform/kyverno/admission/kustomization.yaml` is a **silent