Sync Python preprocessor fixtures and fix multi-instruction heuristic parity

[rlippmann]

Summary

• Sync preprocessor fixtures from Python source-of-truth into TS (tests/fixtures/preprocessor).
• Update CI Python fixture SHA pin in .github/workflows/ci.yml to the fixture commit that introduced the new preprocessor fixtures.
• Fix TS heuristic parity for the fixture case multi-instruction-use-docker-actually-prohibit-unknown so "use docker, actually prohibit docker" is classified as unknown.

Why

• Python is authoritative for preprocessor behavior and fixture corpus.
• TS was behind on newly added Python preprocessor fixtures.
• After sync, one fixture-backed parity failure remained in TS heuristic behavior and required a minimal fix.

Scope checklist

• Diff is minimal and scoped to the requested behavior
• Python/spec parity is preserved (or mismatch is explicitly documented)
• Fixture semantics are respected (exact string vs non-empty null rule)
• No unrelated refactors
• Relevant validation was run (npm test for behavior changes, or docs-only/no-runtime-change)

Notes

• Commits are intentionally split:
  1. test: sync preprocessor fixtures and update python fixture pin
  2. fix: reject multi-instruction docker contradiction in heuristic
• Added fixtures are direct Python fixture sync artifacts; no TS-only semantics were introduced.

Validation details:

• npm test: passed
• If not run, why: n/a