fix(ci): silence CI/tool noise found auditing the test-job log

An audit of a full green run's test + build-docs logs (agy scan, spot-
checked) turned up stray output beyond the mkrep git-init hint already
fixed. Two real bugs, plus CI-config cosmetics:

- agents-vault.fish/agents-init.fish: `set -l x (some_fish_function ...)`
  command substitutions do not inherit a caller-scoped stderr redirect in
  fish (proven with a two-line repro: `outer 2>/dev/null` where outer
  does `set -l x (inner)` still leaks inner's stderr to the real
  terminal). This let _agents_repo_ensure_symlink's and
  _agents_repo_sync's raw internal error messages leak past `--silent`
  for real users too, always duplicating the clean summary message each
  caller already echoes on failure. Fixed at all 4 call sites by adding
  an explicit `2>/dev/null` directly on each command substitution, since
  a redirect on the outer call cannot reach it.
- ci.yml: apt-get install missing `apt-utils`, so debconf printed
  "delaying package configuration" on every install in both jobs --
  installing it first fixes the chicken-and-egg.
- ci.yml: added `NODE_OPTIONS: --no-deprecation` at the build-docs job
  level to silence Node's internal punycode-module deprecation notice
  (astro's toolchain still pulls it in transitively).
- ci.yml: `npm ci --no-fund` drops the funding nag.
- ci.yml: `gpg --batch --quiet --import` drops gpg's normal-case import
  status lines during the bot commit-signing setup.

Deliberately NOT silenced: npm's deprecated-glob warning, its audit
vulnerability summary, and its allow-scripts notice about esbuild's
postinstall -- these are genuine dependency-hygiene signal, not noise,
and no workflow-level flag exists to hide them without also hiding real
future findings. Also not fixable here: a Gitea Actions/act runner
warning ('runs-on' key not defined in CI/test) that traces to neither
workflow YAML in this repo -- both already set runs-on on every job,
confirmed twice; it's runner-internal, like actions/checkout's own
git-init hint in its Checkout-step preamble.

Verified: full suite 730/730 passing ($status 0); the exact mkdir-
collision repro that surfaced the command-substitution bug re-run
clean (rc=1, empty stderr); test-agents-vault.fish standalone,
320/320, zero occurrences of the previously-leaked messages.

.github/workflows/ci.yml

@@ -48,7 +48,9 @@ jobs:
       - name: Install fish
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils first: its absence is what makes debconf print
+          # "delaying package configuration" on every install below.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish
@@ -65,6 +67,11 @@ jobs:
         ((github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all') &&
           needs.test.result == 'success'))
     runs-on: racknerd-mini
+    env:
+      # Silences Node's internal "punycode module is deprecated" notice
+      # (astro's toolchain still requires it transitively) on every node
+      # invocation in this job, setup-node's own included.
+      NODE_OPTIONS: --no-deprecation
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,7 +81,9 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils first: its absence is what makes debconf print
+          # "delaying package configuration" on every install below.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish
@@ -112,7 +121,7 @@ jobs:
       - name: Build project wiki
         working-directory: docs/site
         run: |
-          npm ci
+          npm ci --no-fund
           npx astro build
 
       - name: Deploy to Cloudflare Pages
@@ -146,7 +155,7 @@ jobs:
           echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
           echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
           command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
-          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import
+          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --quiet --import
           git config user.name  "Gitea Actions Bot"
           git config user.email "fishconfig-bot@git.rootiest.dev"
           git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4