feat: add root-level run-tests.sh full-validation runner (Closes #473)

Adds a canonical, discoverable full-validation entry point so sessions stop
guessing between pytest invocations.

- run-tests.sh: executable root runner; runs `venv/bin/python -m pytest "$@"`;
  forwards args; fails closed with a clear setup message when the venv Python
  is missing (no silent wrong-interpreter fallback); set -euo pipefail; no
  network, no Gitea, no lock files.
- docs/developer-testing-guidelines.md: name ./run-tests.sh as the canonical
  full/focused validation command.
- tests/test_run_tests_script.py: contract checks (exists, executable, strict
  bash flags, venv pytest + arg forwarding, fail-closed guard, repo-local, and
  the guide naming the runner).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/developer-testing-guidelines.md

@@ -13,6 +13,25 @@ credentials.** Every test mocks the HTTP client and the keychain/auth lookup.
 
 ## 1. Standard test commands
 
+### Canonical runner: `./run-tests.sh`
+
+The canonical full-validation command is the root-level runner. It invokes the
+project virtualenv interpreter and passes any extra arguments straight through
+to `pytest`:
+
+```bash
+# Full validation
+./run-tests.sh
+
+# Focused validation (extra args forward to pytest)
+./run-tests.sh tests/test_mcp_server.py -q
+```
+
+`run-tests.sh` runs `venv/bin/python -m pytest "$@"` and fails with a clear
+setup message if the virtualenv Python is missing (so a session never silently
+falls back to the wrong interpreter). The explicit `venv/bin/python -m pytest`
+forms below remain valid and equivalent.
+
 The test suite needs the project virtualenv (it provides the MCP SDK):
 
 ```bash