CI: pasqal credential + keychain tests fail on runners (pre-existing, env-dependent) #111

The unit (linux) job fails identically on local/amicode and on every PR — 8 tests, all in the pasqal credential surface:

• pasqal submit — validator spawn contract (169 AC1)
• pasqal submit — token-only persistence + device metadata (169 AC2) (×2)
• pasqal submit — null token → session-only (169 AC4)
• pasqal revalidate — freshness + keychain silent re-auth (×2)
• mtime staleness — hand-edited credential file (170 AC1)
• opencode run — unknown model exits nonzero (regression #27371)

Signature: spawned-validator and keychain paths on a headless runner. These fail on the base branch, so PRs currently merge with red unit (typecheck green is the effective gate). Either env-gate them (the telaio convention: skip loudly when the host lacks the dependency) or provision the validator in CI. Until then, e2e never runs (it waits on unit), which is the real cost — e2e coverage is silently zero.