fix(ci): make the cluster-global serial group actually group - #816

`.config/nextest.toml` filtered the serial minority with `test(/name/)`, but every
name in that list is a test BINARY name and `test()` matches TEST names. The
group therefore captured only tests whose own name happened to contain the
binary name.

Measured with `cargo nextest show-config test-groups` (cargo-nextest 0.9.138):

  apalis_adapter                     1 of 4 tests grouped
  apalis_schema_contract             1 of 1
  leave_migration_expand_contract    0 of 9

2 of 14 tests across those binaries were serialised, by a control that read as if
it covered all of them. `binary(name)` gives 4/4, 1/1 and 9/9.

This is live regardless of whether the nextest runner is ever adopted: it is the
mechanism ADR-0039 / DN-0005 P3 landed to keep cluster-global mutators off each
other, and it has never worked.

The gate could not have caught it. `check-nextest-config.mjs` asserted that each
name appeared ANYWHERE in the file, which the broken form satisfies -- it
validated spelling while the control was inert. It now asserts the form that
actually groups: `binary(<name>)` present, and `test(<name>)` rejected with the
remedy named. The filter block is extracted first so prose may quote the broken
form while explaining it, and the extractor accepts all three TOML string shapes
rather than only the multi-line one the repo happens to use.

Mutation-proven: committed config -> 0 failures; the exact pre-fix `test()` form
-> 10 failures; one suite dropped from the filter -> 1 failure.

Verified: node tools/ci/check-nextest-config.mjs -> OK;
node --test tools/ci/check-nextest-config.test.mjs -> 7 pass, 0 fail;
npm run check:ci-preflight -> exit 0; dark-suites --strict -> exit 0;
show-config against the committed file -> 4/4 and 9/9.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>