ci: let the pre-push gate accept a make ci run on another host #764

Area: local validation, the pre-push gate

Problem

.githooks/pre-push refuses a push that changes code unless tmp/ci-passed-tree-<tree> exists for the pushed commit's tree. The only thing that writes that marker is a successful make ci in the same checkout (scripts/ci-marker.sh write), so every code push needs a full make ci on the contributor's own machine.

That run is heavy, and its cost lands on whatever machine the contributor works on, usually a laptop:

• The unit, integration and e2e suites run under -race with coverage (-coverpkg=./... for integration and e2e).
• The integration suite, the cache backend tests and the e2e orchestrator start their own ClickHouse, Redis, Valkey, Dragonfly, Redis Cluster and dynamodb-local containers through testcontainers, so a local Docker daemon has to carry all of them.
• The Go build cache, the container images and each worktree's node_modules keep growing.

Only the local OS and architecture are ever tested

Because the marker can only come from the checkout itself, the gate only exercises the contributor's own OS and architecture. CI runs on ubuntu-latest (Linux amd64). A contributor on macOS arm64 has no way to run the same make ci on Linux, or on another architecture, and have that run satisfy the gate.

What has to hold

The marker means "make ci passed on exactly this tree". A run on another machine can only count if it keeps that meaning: it tested the exact commit being pushed, and a failed, interrupted or mismatched run writes nothing.

Part of #740.