chore(scripts): treat an expression-built script name as forbidden too (#2146)

Copilot, first review:

- The guard read only literal names, so `npm run smoke:web:${{ matrix.browser }}`
  and `npm run local:${{ matrix.task }}` walked past it — the one form in which
  a forbidden engine reaches CI without anyone typing its name. It already
  refused an expression-valued SMOKE_BROWSER for that exact reason; this applies
  the reasoning consistently. Its limit is now stated: a fully opaque
  `npm run ${{ matrix.script }}` names no family and is not detectable.
- The module header claimed the gate adds "the non-Chromium engine passes";
  it adds Firefox only, and WebKit belongs to neither tier.
- eslint.config.js:33 still said `npm run ci` — the last stale reference.
- AGENTS.md read "everything from `smoke` rightward is `local:gate` only",
  which is two claims wrong: smoke and Storybook run in GitHub CI too, and
  `pack:verify` is in neither tier.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/workflow-gate.test.mjs

@@ -53,6 +53,18 @@ describe("findWorkflowViolations", () => {
       text: "      - run: npm run smoke:web:engine\n",
       rules: [VIOLATION.ENGINE_SCRIPT],
     },
+    {
+      // Copilot, first review: the matrix form is exactly how a forbidden
+      // engine reaches CI without anyone typing its name.
+      name: "flags an engine pass whose name is built from an expression",
+      text: "      - run: npm run smoke:web:${{ matrix.browser }}\n",
+      rules: [VIOLATION.ENGINE_SCRIPT],
+    },
+    {
+      name: "flags a local: script whose name is built from an expression",
+      text: "      - run: npm run local:${{ matrix.task }}\n",
+      rules: [VIOLATION.LOCAL_SCRIPT],
+    },
     {
       name: "flags SMOKE_BROWSER pointed at another engine",
       text: "        env:\n          SMOKE_BROWSER: firefox\n",