CI never runs the workflow-run cleanup test

> 🤖 Generated by the Agentic Engineer

## Evidence

`.github/scripts/delete-old-workflow-runs.test.sh` exists and passes, but **no CI job ever runs it**.

`.github/workflows/ci.yaml` gates shell-script tests behind an explicit allow-list — one `changes`
path filter plus one job per script group. Two such groups exist today (`cask-pr-handoff`,
`eks-smoke-scripts`). The workflow-run cleanup script is in neither, and the only other reference to
it anywhere under `.github/` is the `delete-old-workflow-runs` job name in `maintenance.yaml`, which
invokes the script in production but never its test.

Verified at head `4d8dbcb0` of #6685: `grep -rn "delete-old-workflow-runs" .github/` returns exactly
one hit, in `maintenance.yaml`.

## Impact

The nightly `Maintenance` workflow is the only thing that exercises this script, and it does so
directly against `main`. A regression is therefore discovered by the default branch going red — which
is precisely what happened in #6683 — rather than by a pull request failing.

That makes the test added in #6685 a one-time proof rather than a standing guard: nothing stops the
same class of failure returning.

## Expected

A change to the cleanup script or its test runs that test in CI, and a failure blocks the pull
request instead of reaching `main`.

## Acceptance criteria

- A `changes` path filter covering `.github/scripts/delete-old-workflow-runs.sh`,
`.github/scripts/delete-old-workflow-runs.test.sh`, `.github/fixtures/workflow-run-cleanup/**`,
and `.github/workflows/ci.yaml`.
- A job that `shellcheck`s the script, its test, and its fixture `gh`, then runs the test — mirroring
the existing `eks-smoke-scripts` job.
- The job is wired into `require-checks-in-pr` (both `needs` and `job-results`), as `cask-pr-handoff`
already is, so it actually gates. A skipped path-filtered job is treated as a pass there today, so
this does not block unrelated PRs.
- Proven by a deliberate regression: ablate the fix, confirm the new job fails.

## Size

Small — configuration only, mirroring a pattern already present twice in the same file.

Start in .github/workflows/ci.yaml by comparing the existing cask-pr-handoff and eks-smoke-scripts changes filters and jobs, then inspect require-checks-in-pr. Add coverage for the cleanup script, its test, and .github/fixtures/workflow-run-cleanup/**, including shellcheck and the test run, and wire the job into the required checks. Confirm with a deliberate regression that the new job fails.

Written by the indexing model from the issue text.