census: a run: step written as a flow mapping is not counted by tri gates shell #10569

Goal

The shell census (tri gates shell, pinned by tri census pin --gate) does not count a run: step written as a flow mapping. Measured on the Railway lab against master 8078807: #10568 adds the step - {if: steps.tok.outcome == 'failure', run: echo "..." >> "$GITHUB_STEP_SUMMARY"} to gate-topology.yml, and run: steps reads 325 both before and after. A step the census cannot see is one whose interpreter and quiet shape it never judges.

Boundary

• The census reader behind tri gates shell and tri gates quiet: it should recognise run: as a key inside - { ... } flow mappings, as well as the block form.
• After the fix: re-bless tools/census/shell.txt and tools/census/quiet.txt in the same commit, saying which number moved.

Scenarios

• Given a workflow step - {if: x, run: echo hi}, When tri gates shell reads it, Then run: steps counts it.
• Given a flow-mapped run step with 2>/dev/null ... || echo PASSED, When tri gates quiet reads it, Then it is counted under "failure branch passes".

Requirements

• FR-001: Every run: key a step carries MUST be counted by the shell census, whether the step is written in block or flow form.
• FR-002: The census ledgers MUST be re-blessed in the commit that changes the reading.

Success Criteria

• On master with claw-sarif: ask for no token without a changed .t27, degrade to a step-summary note when the App cannot mint one (Closes #10501) #10568 merged, run: steps reads at least 326.
• tri census pin --gate passes after the re-bless.

Success Criteria

• tri gates shell outputs a run: steps count ≥ 326 (exit 0)
• tri census pin --gate exits 0
• tools/census/shell.txt and tools/census/quiet.txt reflect the new counts (exit 0 when verified)