[scripts] (P7): the pull-library control refuses an empty grep -F pattern in EVIDENCE, and the stub ctest is executable again

- every line of EVIDENCE is a grep -F pattern and an empty line matches everything: a trailing
  newline or a blank line between the two sentences would turn hole 2 into "any red will do".
  The smoke's "red without the transport-resolution message" case catches that (22/23), but
  only when somebody runs it; a `case` after the assignment now refuses a blank line or a
  leading/trailing newline with ::error:: and rc 1, before the selection is counted or the
  library is swapped. The red-check's perturbation line is untouched; smoke 23/23
- scripts/ci/testdata/stub_ctest.sh went 100755 -> 100644 in the round-2 commit that added
  its retrace-evidence-nolog mode (a Windows-mount artefact); restored with
  `git update-index --chmod=+x`. The smoke copies it and chmods the copy, so nothing ran
  differently

scripts/ci/retrace_pull_library_control.sh

@@ -68,6 +68,16 @@ mkdir -p "${CONTROL_TMPDIR}"
 # retrace-evidence-nolog mode reproduces the shape.
 EVIDENCE='never reported resolving it
 no evidence the transport ever resolved'
+# EVERY LINE OF EVIDENCE IS A PATTERN, SO AN EMPTY LINE IS A PATTERN THAT MATCHES EVERYTHING. A
+# trailing newline, or a blank line between the two sentences, would turn hole 2's check below
+# into "any red will do". The smoke test's "red without the transport-resolution message" case
+# would catch that (22/23), but only once somebody ran it; this refuses it here, before the
+# selection is counted or the library is swapped.
+case "${EVIDENCE}" in
+  *$'\n\n'*|*$'\n'|$'\n'*)
+    echo "::error::EVIDENCE carries an empty grep -F pattern (a blank line or a leading/trailing newline), which would match every failure"
+    exit 1;;
+esac
 
 selector="^MobileGLTraceReplay\.${CASE}\.${BACKEND}$"