[zackees]

Batch 19, ci.yml part. Selftest (with PyYAML): 1647 tests OK; local gate passed.

Refs #132

RUST-017: false negative in ci/*.py scripts invoked as modules

Found while fixing running-process for #132: ci/independent_spawn.py passes test-serializing flags, but precheck reported nothing. There were two causes:

1. Module invocation. The workflow runs the script as uv run --no-project --module ci.independent_spawn, and the scanner only followed ci/*.py paths. test_invocations now also follows -m ci.foo / --module ci.foo → ci/foo.py, only for modules under ci and only when the file exists.
2. Helper-built commands. The test command comes from cargo_command("test", …) in ci/soldr.py, so the word "cargo" never appears as a command in the script. rust_nocapture now also treats a script as building a test command when it calls a *cargo* function whose first argument is the literal "test"/"nextest". The rest of the argv is assembled at runtime, so these findings are needs_review (the rule's existing status for that case), not violations.

Result on running-process: six new needs_review findings in ci/independent_spawn.py; the existing findings are unchanged. ci/independent_broker_docker.py stays out of scope: its flag goes to a prebuilt test binary in docker run, not to a cargo test/nextest run, and it runs a single test.

Because the module-reference change lives in the shared scanner, RUST-015, RUST-016, CPP-001, TEST-003 and PKG-010 now also see module-invoked scripts. The selftest is unchanged.

Fleet work this batch, outside this repo:

• chore(ci): bump setup-soldr to v0.9.86 (Dylint caches save; zackees/ci.yml#31) FastLED/fbuild#1744: the setup-soldr pin moved into ci/render_workflows.py, the source of truth, so Render-and-diff passes.
• fix(cli): adopt same-version cache-root owner daemon; fail fast on a foreign owner FastLED/fbuild#1739: its test fixture's pid: 42 tripped the USB VID/PID literal guard; it now uses std::process::id().