feat(run-ginkgo): add a validated flake-attempts input

[sydorovdmytro]

References DEVOPS-1453

One flaky spec out of 190 reddened the v0.34.8-rc.2 bump PR and stalled that
release cut for two hours. run-ginkgo had no flake-retry knob, so the only
options were a manual re-run or nothing.

Adds flake-attempts. Ginkgo retries only the spec that failed, so the cost is
one spec's runtime, not a whole job. Default stays 1 (ginkgo's own default),
which adds no flag at all, so this is inert for every existing caller — the
release-branch wiring that actually sets 2 is a separate vcluster-pro PR, which
is why this references rather than closes the issue.

Retried specs are not hidden. Ginkgo reports a spec that passed on a retry as
State: passed, so the summary counts them separately using ginkgo's own
CountOfFlakedSpecs predicate, and qualifies the headline rather than printing an
unbroken "All tests passed!" above a flaked count. Without that, turning retries
on would erase the evidence that a suite is degrading — on a release bump PR,
exactly the signal worth keeping.

A value that is not an integer >= 1 warns and is dropped rather than forwarded:
ginkgo rejects it too, but only after suite setup, which turns a typo into a
failed job minutes later. Leading zeros are normalized, since 08 satisfies
^[0-9]+$ but is an invalid octal literal in (( )) and is also rejected by Go's
flag package.

Test plan

• make test-run-ginkgo — 97 pass, 0 fail (96 bats cases; 15 new)
• shellcheck on both changed scripts, make check-docs — clean
• Mutation-tested both directions rather than asserted: an early exit 0 before
  invoking ginkgo now fails the default-path test (it left all cases green
  before), and deleting the NumAttempts > 1 clause now fails the clean-run test
• Verified against a real ginkgo report that a retried-then-passed spec is
  State: passed with NumAttempts: 2, and that the summary reports it

[loft-bot]

Panel review: 1 blocking, 4 quality notes, 7 lanes.

Blocking concerns

• .github/actions/run-ginkgo/test/execute-tests.bats:187 — the two negative-only flake-attempts cases stay green even when the script never invokes ginkgo on the default path.

What was checked

Checked: correctness, security, test-quality, operability, architecture, typos, PR metadata, cross-PR symbol conflicts. Skipped: the e2e-family and coverage-gap lanes (this repo has no e2e*/ suite), infra (no workflow, Helm, Terraform, Dockerfile or k8s manifest changed — only a composite action manifest), reuse (no new helper; the added jq predicate follows the shape of its four sibling lines), dead-code (nothing deleted or renamed), layout coherence (no renames).

Verified rather than assumed: ginkgo v2.32.1 really does emit NumAttempts and MaxFlakeAttempts in its JSON report, so the new hand-written fixture is faithful and the flaked predicate does fire in production, matching upstream CountOfFlakedSpecs exactly. The blocking finding was reproduced by running the real bats suite against a mutated script.

PR-level notes

• nit — the issue is linked as "Part of DEVOPS-1453."; the repo convention is Closes <ID>, or References <ID> for a sibling PR in a multi-repo change, which is the case that fits here.
• nit — the test plan says "89 pass, 0 fail (5 new)"; the tree has 90 bats cases with 7 new. The 5 matches only execute-tests.bats, omitting the 2 added later for the flaked count — the plan looks like it was not refreshed as the PR grew.

Quality notes (non-blocking)

• consider .github/actions/run-ginkgo/action.yml:46 — this 226-char description widens the generated DESCRIPTION column from 141 to 253 chars across all 12 rows, since auto-doc pads every cell to the widest. Convention here is a short description with the rationale as README prose; rerun-failed-only has its own section but flake-attempts gets none, so the when-to-use-2 guidance and the new 🔁 Flaked (passed on retry) line have nowhere durable to live.
• consider .github/actions/run-ginkgo/test/generate-summary.bats:288 — "…even with retries enabled" runs against all-passed.json, which carries no flake fields, so retries are never actually exercised; dropping the NumAttempts > 1 clause entirely leaves it green. The fixture needed is already present as the "clean pass" entry in with-flakes.json (MaxFlakeAttempts: 2, NumAttempts: 1). This becomes blocking if the sibling test's exact-count assertion is ever relaxed, since that clause would then be wholly untested.
• consider .github/actions/run-ginkgo/src/execute-tests.sh:49 — (( … )) && GINKGO_ARGS+=(…) departs from the if … then form used by the three sibling conditional appends in this same file. Harmless today because statements follow it, but it exits non-zero under set -e the moment it becomes the last statement of a block or moves into a function.
• nit .github/actions/run-ginkgo/src/execute-tests.sh:48 — a leading-zero value such as 08 passes the ^[0-9]+$ regex but is an invalid octal literal in (( )), so bash prints a raw value too great for base error alongside the intended warning. Worth noting a bare 10# fix is not a drop-in: it would accept 08 and then forward 08 to ginkgo, which rejects it (Go's flag package parses ints with base auto-detection), so the forwarded value needs normalizing too.