Download each Google Sheet once per run, not once per xdist worker

[gaurav]

pytest --target ci-es -n auto tests/nameres/ intermittently died before running anything:

ERROR tests/nameres/test_blocklist.py - requests.exceptions.ConnectTimeout: H...
ERROR gw2 - Different tests were collected between gw0 and gw2
ERROR gw1 - Different tests were collected between gw0 and gw1
14 errors in 1.28s

test_blocklist.py builds its parametrization in pytest_generate_tests, which runs in
every xdist worker, and it was the one collection-time sheet download with no cache: -n auto fired 14 simultaneous requests at Google's unauthenticated gviz endpoint with a 10s
timeout and no retry. Any one of them failing makes that worker collect a different set of
tests, and xdist then aborts the whole run. dashboard.yaml runs -n 8 against every
target daily, so this was live in CI, where it surfaces as the "Target run broke"
annotation with no results written for that target.

GoogleSheetTestCases already had the fix — a FileLocked download cached under
cache_dir() — so this PR lifts that into sources.google_sheets.fetch_sheet_csv() and
routes both sheets through it. Verified by logging each fetch during a --target ci-es -n auto tests/nameres/ run: 14 blocklist downloads before, 1 after, with the same
165/162/117/1950 outcome split.

Two other things this turned up

A failed download printed the sheet ID. requests puts the request URL in its exception
message, and for an unauthenticated CSV export that URL is the capability that grants
access to the sheet. A transient Google error therefore wrote it into pytest's output — and
dashboard.yaml runs pytest on a public repository, so that is a public Actions log. The
helper now re-raises with the status line only. from None rather than from e is the
substance of it: pytest prints an exception chain in full, so suppressing the context is
what actually stops the original message being published. No rotation was needed — this was
found by injecting a failure locally, not in a published log.

The start-of-run cache sweep was globbing the wrong directory. cache_dir() read
BABEL_VALIDATION_CACHE_DIR straight from os.environ, but nothing loads .env except
resolve_sheet_id(). So its answer changed part-way through a process: tests/conftest.py
asks at import time and got ~/.cache/babel-validation, while the downloads ask afterwards
and got the override. For anyone with the override set, pytest_configure's gsheet_*.csv
sweep has been deleting nothing, and the caches it exists to clear only aged out on the
one-hour TTL.

That is a second, independent route to the same error, and one that needs no network
failure: a cache that expires between one worker's collection and the next leaves half the
run reading the old sheet and half re-downloading it. It also left
unlink_if_exists()'s containment check comparing against a cache_dir() that could move
under it, which raises and aborts the run outright. cache_dir() now loads .env itself,
once per process — not per call, because load_dotenv() re-sets a key that has been
deleted, which would make the override impossible to unset in a test.

Gotchas worth keeping

• The cache key now covers the tab name as well as the sheet ID. Two tabs of one sheet are
  two different CSVs and must not share a file. Existing gsheet_*.csv are orphaned by the
  new key, which costs one download.
• The sheet ID is no longer kept on the GoogleSheetTestCases instance. Nothing read it,
  and that object's str() reaches assertion messages the dashboard publishes.
• Both new invariants were checked by mutation — reverting from None to from e, and
  putting the uncached requests.get back — with __pycache__ cleared between runs.
• The blocklist CSV fixture is built with the csv module: several real column names
  contain a comma or a quote, and a hand-written header silently shifts every field by one.

Testing

• pytest -m unit — 201 passed (was 192).
• pytest --target ci-es -n auto tests/nameres/ — same failure/pass split as before the
  change, no xdist errors.
• pytest tests --target dev -n 8 -k <no match> — the whole tree collects identically
  across 8 workers.

The remaining tests/nameres failures against ci-es are findings about NameRes ES, not
defects in this repo; they are what the validate-nameres-es branch is for.