Run the integration suite in CI again

[wayneeseguin]

The 3400-line end-to-end suite in ci/scripts/tests has not run in CI, and
both CI entry points fail before reaching it. Three independent breakages,
one consequence.

What broke

The suite stopped being invoked. 72188a2 (2023) wired the pipeline to
make test with a suite-runner target:

test: $(if $(wildcard $(SAFE_PATH)),use,build)
	$(TEST_PATH) $(SAFE_PATH) ${VAULT_VERSIONS}

test was later modernized to go test -race. ci/scripts/test-release-against-vault
still passes TEST_PATH, SAFE_PATH, and VAULT_VERSIONS, but make accepts
unknown variables silently, so all three were ignored and only unit tests ran.

Every test-vault-* job bailed at startup. The script guarded on
VAULT_VERSION; all five jobs pass VAULT_VERSIONS. Under set -u the guard
fired every time with "VAULT_VERSION must be set … Did you misconfigure
Concourse?"

Every pull-request build failed. test-pr runs ci/scripts/test, deleted
in that same 2023 commit while the job kept referencing it.

What this does

• adds test-integration, which passes TEST_PATH/SAFE_PATH/VAULT_VERSIONS
  through to the suite — kept separate from test so check stays hermetic
• guards and reports VAULT_VERSIONS, and calls the target that runs the suite
• restores ci/scripts/test, running make check only, since the PR job has
  no Vault server

test-integration rebuilds first when driving the in-tree binary. I hit the
alternative during development: a stale ./safe sitting in the tree produced
a red run that had nothing to do with the code under test. An explicitly
overridden SAFE_PATH is still used as given, since CI supplies the release
artifact it means to test.

Verification

• make check green; make test-integration VAULT_VERSIONS=1.13.2 →
  1725 passing, 0 failing, exit 0
• the vault job script was run against a simulated Concourse resource layout:
  it bails with VAULT_VERSIONS unset, and with it set invokes
  make test-integration TEST_PATH=../git-ci/ci/scripts/tests SAFE_PATH=../build/safe-1.2.3-darwin-arm64 VAULT_VERSIONS=…,
  confirmed argument-by-argument so a multi-version value stays one argument
  rather than becoming extra make goals
• the PR script was run from a simulated GOPATH layout: it bails without
  MODULE and reaches a green make check with it

Not verified: none of this ran on Concourse — I have no access to the
pipeline. The scripts and the make target are verified locally against
simulated resource layouts, which covers the wiring but not Concourse's own
load_var, image, or resource behavior. The first real pipeline run is still
the proof.