fix: an allowlist is authoritative — no_run.yaml filters discovery only

[Jammy2211]

Summary

Corrects a rule #261 got wrong. Found by measuring the real workspaces before
writing a single delegator, which is exactly what that measurement was for.

#261's rule would have silently dropped 13 scripts from smoke coverage.

Repo	Allowlisted scripts also named in no_run.yaml
autogalaxy_workspace_test	9
autolens_workspace_test	2
autofit_workspace	1
autolens_workspace	1

Every one of them runs in smoke today. The vendored runners read only
smoke_tests.txt and have never opened no_run.yaml, so honouring it during
the collapse would have been a coverage regression disguised as a refactor —
precisely what #260's "no repo loses behaviour it has today" criterion forbids.

Why the rule was wrong

It conflated two policies for two different runs:

• no_run.yaml → the release mega-run and notebook generation
• smoke_tests.txt / smoke_notebooks.txt → the PR smoke gate

A script legitimately appears in both — excluded from the full build, required
in smoke. "The more specific statement of intent" reasoning in #261 assumed they
were competing statements about the same run. They are not.

So: with --list, the allowlist is the policy and no_run.yaml is not
consulted. Without one, discovery is filtered by no_run.yaml exactly as
before — that path is untouched and pinned by a new test.

Second fix, same root cause

A missing config/build/no_run.yaml is no longer fatal under --list.
autocti_workspace_test has none, and the autohands-level fallback path does
not exist either, so both runners crashed with FileNotFoundError before
running anything — once at module load, and again in parse_no_run_reasons
under --report-dir. That would have taken out one of the four phase-1 repos on
its first CI run.

Discovery still requires the file (a run with no exclusion policy is not a safe
default), and the error now says what to do about it.

Test Plan

• pytest tests/ -q → 389 passed, 5 skipped, 0 failed
• The two tests pinning the old rule are replaced by tests pinning the new
  one, each carrying the measured 13-script rationale
• New test: discovery is untouched — no_run.yaml still skips, with reason
• Tenant-firewall gate → OK
• End-to-end: a script named by both the list and no_run.yaml now runs;
  the autocti_workspace_test shape (no no_run.yaml at all) completes and
  writes its report; discovery without the file still errors clearly

One of the new tests caught a real bug in this very fix — an if allowlist: pass
branch that swallowed the script instead of falling through to the run branch.
Restructured to if not files_are_allowlist and should_skip(...).

Generated by the PyAutoLabs agent workflow.

---

Generated by Claude Code