fix(tests): repair test-runner arithmetic and false-positive checks

Three bugs prevented the validation suite from running cleanly:

- run-tests.sh used `((TESTS_PASSED++))` under `set -e`. Post-increment
  evaluates to the old value, so the first passing test (0 -> 1) made
  `(( ))` return 1 and errexit aborted the whole run after exactly one
  test. Use plain arithmetic assignment instead.
- https-enforcement.sh's comment filter ran `grep -n` (which prefixes
  "linenum:") and then tried to drop comment lines with
  `^[[:space:]]*#`, which never matched the line-number prefix. Every
  http:// URL in a comment (deprecated curl lines, the strict-mode
  attribution comment) was flagged as a violation. Match the prefix.
- 2fa-validation.sh hardcoded `/home/$user/` for the setup-instructions
  check, so for root it looked in /home/root (which does not exist)
  instead of /root. Resolve the home directory with getent.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

Project-Tests/run-tests.sh

@@ -58,10 +58,10 @@ function run_single_test() {
     
     if timeout 300 bash "$test_file"; then
         print_success "✅ $test_name PASSED"
-        ((TESTS_PASSED++))
+        TESTS_PASSED=$((TESTS_PASSED + 1))
     else
         print_error "❌ $test_name FAILED"
-        ((TESTS_FAILED++))
+        TESTS_FAILED=$((TESTS_FAILED + 1))
     fi
 }