forgetest: the lint reads a quoted key only in a matched pair, and a key with one stray quote runs nothing

_KEY_RX took an opening quote and a closing quote each on its own, so a
key with one stray quote read as the bare key: `push":` and
`pull_request':` counted as push and pull_request, where YAML reads the
keys `push"` and `pull_request'`, which are no events; a step's
`run": ...` counted as its run command, and `uses": actions/checkout@v4`
as a checkout. A HOST_TESTED row whose workflow was spelled so passed
the lint, while that workflow runs on no push and runs no such step.

_KEY_RX now reads a quote only as a matched pair. A key with one stray
quote is no key the lint reads, and where the lint reads keys it counts
as running nothing: an event key spelled so makes the `on:` name no
event, and one at the top level, at a job's name or key, or at a step's
key below its dash line makes every step of the workflow count as no
step (each carries "unread", which _on_every_run refuses). So a step's `if": false` still
keeps the step from counting, as it did under the loose reading, and
under a `jobs":` top level, where a job's `if: false` goes unread, no
step counts either. The HOST_TESTED comment says so. The lint only
lists more: a workflow with no such key reads as before.

Proof: forgetest-ci "Unit tests" (`python -B -m unittest discover -s
tests -v` in forgetest): test_manifest.py runs 39 tests, OK, on Windows
with python 3.14 and on Ubuntu 24.04 with python 3.12.
test_the_events_a_workflow_runs_on gains an `on:` with `push":`, and
one with `push:` and `'pull_request:`, each naming no event, and
test_a_step_counts_only_when_every_run_of_the_workflow_runs_it_and_its_failure_fails_the_run
gains a step with `if": false`, a step with `run": ./build/tray_test`,
a job with `if": false` and a `jobs":` top level, none of them running
the test. Negative controls on scratch copies: _KEY_RX as it was fails
the `run":` step and the `push":` event; the matched pairs with no
stray-quote rule fail the `if": false` step and the second `on:`; the
rule at a step's keys alone fails the job's `if": false`. The 17
workflows of the tree's repositories (211 steps) read to the same
events and steps before and after the change. The coverage lint on the
tree manifest from the recipe pins reports 0 uncovered paths, 0
host-tested row problems, 43 tests. pyflakes reports no undefined name.

Acceptance: none. forgetest is dev-only and in no fingerprint (the
source_sha of 43 of 43 tests is unchanged); the lint runs in CI, not in
a campaign, and tests/ are in no fingerprint.

forgetest/tests/test_manifest.py

@@ -329,6 +329,14 @@ class CoverageReportTests(unittest.TestCase):
         # however the step is spelled: more than one space after its dash, or a quoted key
         self.assertFalse(self._runs("steps:\n  -   run: ./build/tray_test\n      if: false\n", test))
         self.assertFalse(self._runs(step % "    \"if\": false\n", test))
+        # a key with one stray quote is no key the lint reads: at a step's key, a job's key or
+        # the top level, no step of the workflow counts
+        self.assertFalse(self._runs(step % "    if\": false\n", test))
+        self.assertFalse(self._runs("steps:\n  - name: x\n    run\": ./build/tray_test\n", test))
+        self.assertFalse(self._runs("jobs:\n  t:\n    if\": false\n    steps:\n      - run: ./build/tray_test\n",
+                                    test))
+        self.assertFalse(self._runs("jobs\":\n  t:\n    if: false\n    steps:\n      - run: ./build/tray_test\n",
+                                    test))
         # a step whose failure the run tolerates proves nothing; literally false is no tolerance
         self.assertFalse(self._runs(step % "    continue-on-error: true\n", test))
         self.assertFalse(self._runs(step % "    continue-on-error: ${{ inputs.soft }}\n", test))
@@ -361,6 +369,9 @@ class CoverageReportTests(unittest.TestCase):
                                              "        type: string\n"), {"workflow_dispatch"})
         self.assertEqual(m.workflow_triggers("on:\n  workflow_call:\n"), {"workflow_call"})
         self.assertEqual(m.workflow_triggers("name: x\njobs:\n  t:\n    steps: []\n"), set())
+        # an event key with one stray quote is no event, and the workflow then names none
+        self.assertEqual(m.workflow_triggers("on:\n  push\":\n"), set())
+        self.assertEqual(m.workflow_triggers("on:\n  push:\n  'pull_request:\n"), set())
 
     def test_the_lint_says_when_it_could_not_read_a_workflow(self):
         import contextlib