[tools] (P7): the wire declines audit carries a self-test whose fixtures must red, and the CI step runs it before the tree audit

Fable review of the B3 rework, should-fix: the audit had no negative
control, so a green run could not say it would have been red. It now takes
--self-test, which writes each inline fixture as a one-file renderer tree in
a temp dir, runs the audit on it and checks both the rc and the line the
audit must print (so a red is red for the fixture's reason):

  comment-only site (//)                -> rc 1, "has NO SITE"
  comment-only site (/* */)             -> rc 1, "has NO SITE"
  string-literal site                   -> rc 1, "has NO SITE"
  other-branch log                      -> rc 1, "with no MGLOG_W/E in its own block"
  nested-branch log                     -> rc 1, same
  log only in a /* */ comment above     -> rc 1, same
  nearest log is MGLOG_D                -> rc 1, same
  good sites (AT form, bare Count under
    its own MGLOG_E_ONCE, def row with a
    trailing comment)                   -> rc 0, "0 unlogged, 0 unknown"

8/8, rc 0. Mutants: with the strip disabled 5 of 8 fail (the four
comment/string reds go green and the good fixture's commented row is
lost); with the old 8-line window in place of the block walk 2 of 8 fail
(other-branch, nested-branch). Against the audit as it stood at aab01275,
six of the seven red fixtures passed and the good one failed.

.github/workflows/test.yml: the "Wire declines audit (B3)" step runs
--self-test and then the tree audit, the way the next step runs
trace_cases.py --self-test-transport-matrices before it computes matrices.

.github/workflows/test.yml

@@ -2393,9 +2393,13 @@ jobs:
         run: python3 scripts/ci/fatal_census.py
 
       # The decline half of rule I (P7 B3): every WireDeclines.def row has a site, every site a
-      # warning-or-error line. Same shape as the census - tree-only, no build.
+      # warning-or-error line. Same shape as the census - tree-only, no build. The self-test
+      # runs first: its fixtures (a site only in a comment or a string, a log in another
+      # branch, an MGLOG_D) must red, so a green audit is one that could have been red.
       - name: Wire declines audit (B3)
-        run: python3 scripts/ci/wire_declines_audit.py
+        run: |
+          python3 scripts/ci/wire_declines_audit.py --self-test
+          python3 scripts/ci/wire_declines_audit.py
 
       - name: Load trace cases
         id: trace-cases