Workflows are consolidated by trigger and named on the trigger/outcome convention

## Summary

Adopt one workflow file per distinct trigger, and name workflows and jobs
on the trigger/outcome convention: the workflow `name:` says when it runs,
the job `name:` says what it produces.

## Motivation

Two halves of one migration, filed apart only because the naming convention
arrived after this issue did. Every sibling repo landed both in a single
upstream change, and they touch the same files.

Consolidation: adding `bats.yml` (#127 / #264) surfaced that it and
`pre-commit.yml` have identical `on:` (`pull_request` + `push` to `main`)
and identical `permissions:` (`contents: read`). A workflow file is the unit
that owns a trigger surface; two files with the same surface are better
expressed as two jobs in one workflow. The current split is incidental —
each was added in its own PR — not driven by any divergence.

Naming: the convention was worked out in alunduil/woodland-generators#383,
recorded as alunduil-chezmoi ADR 0004, and is codified globally in
alunduil/alunduil-chezmoi#413. The workflow `name:` names the trigger or
cadence; the job `name:` names the outcome as a human-readable phrase; the
job id stays a kebab wiring identifier and is never reused as the name.
`alunduil-chezmoi` and `blog.alunduil.com` have both finished it.

This repo has not, and it is now load-bearing rather than cosmetic:
rulesets match the bare job name, so #216 would pin context strings that the
rename invalidates, deadlocking every merge until the ruleset changes in the
same commit.

## Scope

Audit the six workflows and classify by trigger:

- `pre-commit.yml` (`name: pre-commit`) and `bats.yml` (`name: bats`) —
same triggers, same permissions → one `ci.yml` (`name: CI`) with jobs
named for their outcome (`Run pre-commit hooks`, `Test shell scripts`,
following `alunduil-chezmoi`'s phrasing).
- `terraform-plan.yml` (`pull_request`) and `terraform-apply.yml` (`push`
to `main` + `workflow_dispatch`) — diverge on trigger → stay split. Both
need naming work: `terraform-apply.yml` keys its job `run` with no
`name:`, so its context is the bare `run`; `terraform-plan.yml`'s `plan`
job carries `name: terraform-plan`, a bare id the convention rules out.
Its `changes` job (`Detect terraform changes`) already conforms.
- `daily.yml` already conforms (`Daily` / `Prune stale pull requests`).
- `sync-project.yml` (`name: sync-project`) — `schedule` +
`workflow_dispatch`, the same trigger family as `daily.yml`, and its
`environment:` is per-job scopable so it forces nothing. Decide whether
the differing cadence justifies the split; its job name
(`Sync the Inbox board`) already conforms.

Reconcile the per-file differences a merge surfaces: `bats.yml` carries a
`concurrency` group and runs `ubuntu-24.04`, `pre-commit.yml` has neither
and runs `ubuntu-latest`. `runs-on` is per-job so both survive; `concurrency`
is per-workflow and would then cover both jobs.

## Acceptance criteria

- [ ] Workflows sharing a trigger live in one file as separate jobs; those
that diverge remain in their own files
- [ ] Every job carries a `name:` that is a human-readable outcome phrase,
unique repo-wide, and never the bare job id
- [ ] The consolidation preserves each job's behavior (same checks run on
the same events with the same permissions)
- [ ] The resulting context names are recorded here, so #216 can pin them
without a second rename

## Additional context

- Follow-up from #264 (adds `bats.yml`), landed as its own file to keep
that PR scoped.
- Convention: alunduil/woodland-generators#383 (worked example),
alunduil-chezmoi ADR 0004, alunduil/alunduil-chezmoi#413 (global
codification). No repo-local restatement needed once that lands.
- Blocks #216, which pins `All hooks` and `terraform-plan`. Sibling
migrations: #300 / #304 (blog), #406 (chezmoi).