tree-sitter: enable CI to verify scripts contain proper guards

capa-testfiles now stores script files and we've had a bit of discussion surrounding the safest way to do this. We've landed on ensuring all files are stored without exec bit (with CI check for new files) and defanged file extension (e.g. `.sh_`). Additionally, we've added a guard at the top of each script file to provide an extra layer of protection.

For Bash:
```bash
echo "FATAL: This file is a static analysis fixture and must never be executed!" >&2
return 1 2>/dev/null || exit 1
```
For Python:
```python
import sys
sys.exit("FATAL: This file is a static analysis fixture and must never be executed!")
```

The downside is that we're modifying the original file which changes the hash, offsets, etc.. However, I think this is a reasonable compromise being that these files are only used for capa's test harness.

We should enable the CI to ensure these guards are added to the corresponding files before they are committed.

Start by locating the repository's CI configuration and the capa-testfiles fixture directories referenced in the issue, then inspect how new files are currently checked. Add verification that corresponding Bash and Python scripts contain the specified guard, and run the relevant CI checks to confirm unguarded new files fail while guarded fixtures pass.

Written by the indexing model from the issue text.