ci_tier_check: accepted limits (matrix include/exclude, run-script expressions, aggregator || true, schedule) — fix only if seen in practice

[InauguralPhysicist]

Accepted limits of tools/ci_tier_check.sh after #1273, filed per the out-of-scope and one-layer rules (#1275). Each is a constructed mutant of the checker, and none has an instance in the real workflows today. Fix one only if it ever occurs in practice; until then, code review covers it.

1. Matrix include/exclude: an include: [{os: macos-15-intel}] adds a leg that is not required and is not flagged (the original ci: adopt platform tiers — fast merge-blocking set decides main's color; slow/port lanes post-merge; contributor precheck; unenrolled-test gate #1264 macOS shape); an exclude of a required leg means that check never reports. Repro: /tmp/astra-1264A-r2/ round-2 evidence (see ci: platform tiers — .github/required-checks.txt is the tier-1 source of truth, enforced by tools/ci_tier_check.sh (#1264) #1273).
2. The stale-waiver check (step-output waivers pinned by hash) has no selftest plant.
3. ${{ }} expressions inside run: scripts, runs-on and container are not judged.
4. An aggregator whose script ignores a failed worker (|| true), and a schedule: trigger on ci.yml: code-review concerns by design (ci: platform tiers — .github/required-checks.txt is the tier-1 source of truth, enforced by tools/ci_tier_check.sh (#1264) #1273 round-2 scope cut).