Clear the last tenant-firewall finding + gate Hands PRs - #237

The PyAutoHands leg of the tenant-firewall arc (PyAutoMind#198), deferred
at the time because PyAutoHands was claimed by the version-stamp task
(#235). That merged as #236, so the leg is unblocked.

This is the last of the 9 findings. With it, a four-organ
`repos_sync.py --check` reports `tenant firewall (organ code): OK`.

- tests/test_pre_build_staging.py: derive the five arbitrary repo literals
  from the already-parsed SPECS, the mechanism the file adopted precisely
  so its fixtures cannot drift from pre_build.sh. The three tests that
  already used SPECS[i][0] are untouched — only the hand-written names
  change. The `pyautobase` fixture root becomes a neutral name;
  pre_build.sh derives PYAUTOBASE from its own location, so the root is
  never matched by name. Fixture assert tightened to `len(SPECS) > 1`,
  which the missing-checkout test now relies on (it removes one repo and
  asserts against another).
- .github/workflows/tests.yml: check Hands out at `path: PyAutoHands`
  beside a pinned PyAutoMind, move pytest under `working-directory:`, and
  add the `--only "tenant firewall (organ code)"` gate step — the same
  shape PyAutoBrain and PyAutoHeart already carry. Every firewall finding
  to date merged through a green PR because no PR CI ran the check; this
  closes that hole for Hands. The header's "deliberately ONLY pytest"
  paragraph is updated rather than left contradicting the new step.

Verification: `--only "tenant firewall (organ code)"` against a
four-organ root → OK, exit 0. Negative probe: injecting a bogus manifest
name into the genericised file is flagged (exit 1) and removing it
returns OK, so the check is not weakened. pytest unchanged against
pristine main in this container — 302 passed / 4 skipped / 7 failed both
before and after, the 7 being an environment gap (ipynb-py-convert has no
wheel here), not a regression.

Follow-up owed on PyAutoMind: add the PyAutoHands checkout to
`firewall_gate.yml`, which deliberately omitted it while Hands main still
carried this finding. That must merge after this PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013xP1c7XRVQJzxoWAoH92GQ