jupiter_one: add script test for routing rules

Part of #20449.

## What

Add a script test to verify that asset documents with Vulnerability, Alert, or Finding classes are correctly routed from the `asset` data stream to the `risks_and_alerts` data stream.

## Routing rules

```yaml
- source_dataset: jupiter_one.asset
rules:
- target_dataset: jupiter_one.risks_and_alerts
if: "ctx.jupiter_one.asset.entity._class.contains('Vulnerability') || ctx.jupiter_one.asset.entity._class.contains('Alert') || ctx.jupiter_one.asset.entity._class.contains('Finding')"
```

## Implementation

Add two files under `packages/jupiter_one/data_stream/asset/_dev/test/scripts/`:

1. **`env.txt`** — smoke test verifying PACKAGE_NAME, DATA_STREAM, CURRENT_VERSION env vars.
2. **`routed_data_streams.txt`** — full routing test:
- No existing Docker mock — embed an `elastic/stream` mock in the txtar file that serves canned CEL/API responses including both regular asset entities and Vulnerability/Alert/Finding class entities
- Install package, create policy pointing at the mock
- `get_docs` on `logs-jupiter_one.asset-*` to verify non-risk entities remain in source
- `get_docs` on `logs-jupiter_one.risks_and_alerts-*` to verify risk entities were routed
- Assert on `jupiter_one.asset.entity._class` field with `jq`

## Exemplar

Follow the pattern in `packages/entityanalytics_ad/data_stream/entity/_dev/test/scripts/routed_data_streams.txt`.

## Complexity

Tier 3 — no existing system tests or Docker mock. Need an embedded CEL-compatible mock serving JupiterOne GraphQL API responses.

## Test samples

We can construct samples based on the pipeline test data and documentation is not available. We will need to obtain samples from a real endpoint.

Start by comparing packages/entityanalytics_ad/data_stream/entity/_dev/test/scripts/routed_data_streams.txt with the two new scripts under packages/jupiter_one/data_stream/asset/_dev/test/scripts/. Build the embedded elastic/stream mock from the described CEL/API responses, then verify the environment variables and that regular assets stay in logs-jupiter_one.asset-* while Vulnerability, Alert, and Finding entities appear in logs-jupiter_one.risks_and_alerts-* with jq assertions.

Written by the indexing model from the issue text.