refactor: consolidate the tools on shared/, and split triage.py

[Bilb]

Stacked on #59, which created shared/. This finishes the job: what the tools still duplicated moves into shared/, the zendesk scripts stop reaching it through triage.py, and triage.py is split into the pieces the other scripts actually need.

shared/

• shared.text: clip, squash, window_label, undash_english. Pure string work that prompts, ticket fields and Discord lines all did.
• shared.state.Tracker: binds a digest's schema version, item key, activity field and retention once. The new/changed/unchanged partition and the record-building both digests carried side by side now live here.
• shared.discord.delivered_ids: what a partial post covered, so the state records only what Discord accepted.
• get_env(default=) for settings that are optional with a fallback.
• shared.testing: raise_for_status on the fake response, a context-manager fake session, and an Env swap, so no test file defines its own.

zendesk_triage

note_reply, resolve_reviews and deploy/alert.py imported the 1900-line classifier to reach a retry loop, a marker format or the CLI's name; relay imported it and used nothing. They now import what they use:

module	holds
zendesk.py	the API session, search and its 1000-result ceiling, one ticket, its comments and users, the one PUT every write is, the markers, who the customer is on a channel integration, what an imported store review looks like
claude_cli.py	run_json, and try_run_json for an enrichment that hands the failure back instead of exiting (three copies of the catch-SystemExit idiom collapse into it)
transcript.py	the English transcript end to end: translate, render, write, attach

triage.py keeps the queries, taxonomy, dedup, review filter, analysis and rendering: 1091 lines, from 1913.

Two behaviour changes on purpose: the three comment fetchers differed only in page size, order and whether a failure exits or skips the ticket, so they are one fetch_comments with those as parameters; and note_reply --model now goes through resolve_api_model like the triage's does, so sonnet works for both rather than one.

crowdin

download_translations_from_crowdin.py had its own retry loop: 429 only, no 5xx, int(Retry-After) that crashed on the date form the RFC allows, no session. It now uses shared.retry on one session, with the export downloads on a second unauthenticated session because they are served from a signed URL on another host. Arguments parse in main instead of at import, which is what let it get tests. Every argument the workflow passes is unchanged.

CI

Nothing ran the test suites before. tests.yml runs all six on pull requests, one job per directory because two requirements files pin requests differently. sogs_moderation runs on the system interpreter with a --system-site-packages venv, since python3-session-util ships as a deb from deb.session.foundation rather than a wheel.

Testing

Every suite locally: shared 63, github_prs, zendesk_triage 444, deploy, crowdin 23. sogs_moderation needs the apt package, so the CI job is its first run.

Left for later, deliberately: a shared.crowdin for the API base, token lookup and pagination copied across three crowdin scripts, and sogs_moderation, whose signed requests cannot be retried generically.