Prepare hosted app tests for optional sharding

[morluto]

Summary

Adds the runner mechanics and suite metadata needed to canary process-level sharding for hosted app tests. Default CI behavior remains serial because --workers defaults to 1.

What Changed

• Added Scripts/Fixtures/ci-test-serial-groups.json for shared-resource serial lanes.
• Extended Scripts/ci_app_test_runner.py with:
  • --ledger
  • --serial-group-policy
  • --workers
  • --print-suite-plan-json
• Aggregates contract-ledger rows into suite-level tags, runtime estimates, and execution tiers.
• Classifies suites as pinned serial or parallel eligible.
• Keeps pinned suites out of the worker pool when --workers > 1.
• Stops in-flight suite subprocesses through the existing process cleanup path after a failure.
• Adds runner self-tests for policy parsing, suite planning, serial ordering, worker scheduling, fail-fast behavior, and missing config errors.
• Adds targeted teardown for known shared-state suites.
• Updates ledger tags for touched suites without changing scenario counts or method IDs.

Review Notes

Suggested review order:

1. Scripts/ci_app_test_runner.py
2. Scripts/test_ci_app_test_runner.py
3. Scripts/Fixtures/ci-test-serial-groups.json
4. Scripts/Fixtures/test-suite-contract-ledger.tsv
5. Targeted XCTest teardown changes under Tests/RepoPromptTests

The main behavior to verify is that --workers 1 preserves current serial execution, while --workers > 1 schedules only parallel-eligible suites in the worker pool.

Validation

Passed:

• make ci-app-test-runner-selftest
• python3 -m py_compile Scripts/ci_app_test_runner.py Scripts/test_ci_app_test_runner.py
• git diff --check
• make dev-test-shard-plan SHARDS=4
• .agents/skills/rpce-contribution-check/scripts/preflight.sh push
• .agents/skills/rpce-contribution-check/scripts/preflight.sh pr-ready

Scope

This PR does not enable parallel hosted CI. It only adds the config, runner behavior, metadata, and targeted teardown needed for a later canary.