test(ci-guard): the job parser sees inline mappings and unquotes keys

[DemchaAV]

Why

You were right on both counts, and the first version of this PR was the wrong shape:
it recorded a hole in a guard whose contract is no job goes unseen, which documents
the defect and calls it a decision. Closing it does not need a YAML parser.

Verified the grammar at the source rather than assuming it. GitHub's workflow syntax
reference says a <job_id> "must start with a letter or _ and contain only
alphanumeric characters, -, or _", and that the value of jobs.<job_id> is "a map
of the job's configuration data". That settles all three cases, and they are not the
same kind of thing:

Spelling	Before	Now
deploy: {runs-on: ubuntu-latest}	missed silently	parsed as deploy
"build-and-test":	parsed as "build-and-test" — never matches the bare name in needs, so a legal workflow is reported as having an unwatched job	parsed as build-and-test
"security scan":	missed silently	parsed as security scan, then fails as an illegal job id

The inline mapping is the real hole: a map is what the documentation says the value is,
so that workflow is legal and the job was invisible. The quoted key was a false alarm on
a legal workflow — I had called it "loud failure", which was true but not a defence.

What

• The pattern accepts any tail after the colon, keeping YAML's rule that a colon
  separates a key only when a space or a line end follows it.
• unquoted(...) strips one matched surrounding pair, so "build-and-test" and
  build-and-test are the same id. Only a matched pair — a key merely containing a
  quote is untouched.
• everyJobIdIsOneGitHubWouldAccept (new) fails on a job-level key GitHub would
  reject.

I did not take the suggested pattern, and the reason matters. Building the identifier
grammar into the matcher means anything off-grammar is skipped, which is exactly how a
job becomes invisible — the failure #505 removed. This keeps matching structural, so
every job-level key is parsed, and judges legality afterwards where it can be reported.
"security scan" is then a finding rather than a shrug: it is a malformed workflow, not
a rare-but-legal form, so the guard names it instead of passing over it.

Tests

./mvnw -B -ntp clean verify → BUILD SUCCESS; javadoc:javadoc -pl :graph-compose-core
→ exit 0. CiGateCoverageGuardParsingTest 5 → 9, CiGateCoverageGuardTest 2 → 3.

• The tests guard the fix, not describe it. Reverted to the previous pattern:
  aJobWrittenAsAnInlineMappingIsSeen and
  aKeyThatIsNotALegalJobIdIsStillParsedRatherThanSkipped fail.
  quotesAroundAKeyAreNotPartOfTheJobId does not — that fix comes from unquoted(...)
  rather than the pattern, and the two are independent.
• The real workflow parses the same. The new pattern yields exactly the eight jobs
  ci.yml declares — architecture-and-documentation-guards, changes,
  build-and-test, examples-generation, binary-compat, perf-smoke, ci-gate,
  benchmark-diff — and nothing else, so widening the tail did not start matching
  nested keys.

No production code changes.