ci: run aggregate BATS validation without terminal stdin

[codeforester]

Summary

Make the aggregate validation gate deterministic when launched from an interactive terminal. The BATS stage now receives /dev/null as stdin, while tests that need a TTY continue to allocate one explicitly through their PTY helpers.

Issue

Fixes #536

Validation

• bats tests/validate-driver.bats </dev/null — 2/2 passed.
• ShellCheck and git diff --check passed.
• ./tests/validate.sh </dev/null — 700 BATS tests and all subsequent validation stages passed.

Demo Impact

None.

Docs Impact

None.

API Impact

None.

CI Impact

The canonical BATS invocation no longer inherits a maintainer terminal. This prevents timeout supervision and unavailable-terminal assertions from changing outcome based on how validation was launched.

Security Notes

None. The timeout supervisor continues to fail closed for direct foreground-TTY use.

Notes

This PR is intentionally based on #538 (ci/537-20261001-ci-isolate-release-artifact-tests-from-dirty-worktrees) so the aggregate gate is validated with both fixes. Retarget to main after #538 lands.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug> for tracked work.
• Pull request is scoped to one issue.
• Pull request body explains what changed and how it was validated.
• Documentation and public API are unaffected.
• Release and security contracts remain enforced.
• Pull request includes Fixes #536.

[codeforester]

Reviewed against issue #536 and current head c462f11. The aggregate BATS stage is now detached from maintainer terminal stdin while explicit PTY helpers remain available for tests that require a TTY; the new PTY regression test verifies non-terminal stdin. Hosted checks are green (11 pass, 0 fail, 0 pending), and GitHub reports MERGEABLE/CLEAN with no conflicts. No blocking findings in this review. Issue #536 remains open. This PR is correctly stacked on #538, so it is not independently ready for main until its parent is integrated.