fix(test): scope local gate to unit suite [#420]

The full legacy suite mixes repo tests with deployment-target tests
(PAM packages, target resolv.conf, Proxmox repo reachability) that can
only pass on a provisioned server. The workstation gate now runs the
unit suite; validation/security stay invocable for sectestbed runs.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

scripts/test.sh

@@ -2,17 +2,18 @@
 #
 # test.sh — project test runner (framework entry point).
 #
-# Wraps the legacy suite in tests/ so `make test` and the pre-push full
-# audit (scripts/check-rules.sh) have a single canonical entry point.
-# The legacy suite sources the vendored KNELShellFramework; if that ever
-# breaks, add standalone checks here rather than forking the runner.
+# LOCAL GATE: runs the unit suite, which applies to the repo itself and
+# must pass on any workstation ("shift left").
+#
+# The validation/security suites in tests/ are deployment-target tests
+# (PAM/2FA packages, target resolv.conf, external repo reachability) —
+# run them ON a sectestbed/target system, not here:
+#   bash tests/run-tests.sh validation | security
 #
 set -uo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.." || exit 1
 
 status=0
-if [ -f tests/run-tests.sh ]; then
-    bash tests/run-tests.sh || status=1
-fi
+bash tests/run-tests.sh unit || status=1
 
 exit "$status"