Improve offline resilience of CI shell scripts

[2-Coatl]

Summary

• document the resilience work in docs/plans/EXECPLAN_ci_shell_resilience.md
• update the CI smoke tests to expect successful runs with skip reporting and log the new degrade messages
• harden the infrastructure and security shell scripts so missing Django/Bandit triggers skips instead of hard failures, adjust YAML validation quirks, and quote the OpenAPI spec strings; ensure all helper scripts are executable
• ensure the Bandit scan, npm audit, and test-pyramid timing checks degrade immediately when their CLIs or dependencies are unavailable rather than relying on GitHub Actions behaviour

Testing

• pytest scripts/tests/test_ci_shell_scripts.py

---

Codex Task