fix(ci): silence CI/tool noise found auditing the test-job log

An audit of a full green run's test + build-docs logs (agy scan, spot-
checked) turned up stray output beyond the mkrep git-init hint already
fixed. Two real bugs, plus CI-config cosmetics:

- agents-vault.fish/agents-init.fish: `set -l x (some_fish_function ...)`
  command substitutions do not inherit a caller-scoped stderr redirect in
  fish (proven with a two-line repro: `outer 2>/dev/null` where outer
  does `set -l x (inner)` still leaks inner's stderr to the real
  terminal). This let _agents_repo_ensure_symlink's and
  _agents_repo_sync's raw internal error messages leak past `--silent`
  for real users too, always duplicating the clean summary message each
  caller already echoes on failure. Fixed at all 4 call sites by adding
  an explicit `2>/dev/null` directly on each command substitution, since
  a redirect on the outer call cannot reach it.
- ci.yml: apt-get install missing `apt-utils`, so debconf printed
  "delaying package configuration" on every install in both jobs --
  installing it first fixes the chicken-and-egg.
- ci.yml: added `NODE_OPTIONS: --no-deprecation` at the build-docs job
  level to silence Node's internal punycode-module deprecation notice
  (astro's toolchain still pulls it in transitively).
- ci.yml: `npm ci --no-fund` drops the funding nag.
- ci.yml: `gpg --batch --quiet --import` drops gpg's normal-case import
  status lines during the bot commit-signing setup.

Deliberately NOT silenced: npm's deprecated-glob warning, its audit
vulnerability summary, and its allow-scripts notice about esbuild's
postinstall -- these are genuine dependency-hygiene signal, not noise,
and no workflow-level flag exists to hide them without also hiding real
future findings. Also not fixable here: a Gitea Actions/act runner
warning ('runs-on' key not defined in CI/test) that traces to neither
workflow YAML in this repo -- both already set runs-on on every job,
confirmed twice; it's runner-internal, like actions/checkout's own
git-init hint in its Checkout-step preamble.

Verified: full suite 730/730 passing ($status 0); the exact mkdir-
collision repro that surfaced the command-substitution bug re-run
clean (rc=1, empty stderr); test-agents-vault.fish standalone,
320/320, zero occurrences of the previously-leaked messages.

.github/workflows/ci.yml

@@ -48,7 +48,9 @@ jobs:
       - name: Install fish
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils first: its absence is what makes debconf print
+          # "delaying package configuration" on every install below.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish
@@ -65,6 +67,11 @@ jobs:
         ((github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all') &&
           needs.test.result == 'success'))
     runs-on: racknerd-mini
+    env:
+      # Silences Node's internal "punycode module is deprecated" notice
+      # (astro's toolchain still requires it transitively) on every node
+      # invocation in this job, setup-node's own included.
+      NODE_OPTIONS: --no-deprecation
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,7 +81,9 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils first: its absence is what makes debconf print
+          # "delaying package configuration" on every install below.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish
@@ -112,7 +121,7 @@ jobs:
       - name: Build project wiki
         working-directory: docs/site
         run: |
-          npm ci
+          npm ci --no-fund
           npx astro build
 
       - name: Deploy to Cloudflare Pages
@@ -146,7 +155,7 @@ jobs:
           echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
           echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
           command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
-          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import
+          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --quiet --import
           git config user.name  "Gitea Actions Bot"
           git config user.email "fishconfig-bot@git.rootiest.dev"
           git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4

functions/agents-init.fish

@@ -482,7 +482,11 @@ function agents-init --description 'scaffold AGENTS/ sub-repo with agent spec fi
     # a hook-rejected commit fell straight through to a reported success.
     set -l msg "chore: sync AGENTS repository"
     test $did_init -eq 1; and set msg "chore: initialize AGENTS repository"
-    set -l sync_out (_agents_repo_sync "$agents_dir" "$msg")
+    # 2>/dev/null: a command substitution's stderr does not inherit a
+    # caller-scoped redirect on this call (fish quirk), so _agents_repo_sync's
+    # own error message leaks past --silent regardless; it is redundant with
+    # the $sync_rc-driven echoes just below anyway.
+    set -l sync_out (_agents_repo_sync "$agents_dir" "$msg" 2>/dev/null)
     set -l sync_rc $status
     set -l failed 0
     if test $sync_rc -eq 2

functions/agents-vault.fish

@@ -769,7 +769,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped
         if not mkdir -p "$gvault"
             echo "$c_warn""agents-vault: could not create $gvault; skipping global memory$c_reset" >&2
         else
-            set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault")
+            # 2>/dev/null: see the same call's comment further down this
+            # function -- a command substitution's stderr bypasses this
+            # call's own caller-scoped redirect, and the raw message is
+            # always redundant with the $grc-driven echo just below.
+            set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault" 2>/dev/null)
             set -l grc $status
             if test $grc -ne 0
                 echo "$c_warn""agents-vault: could not link $glive; global memory not backed up$c_reset" >&2
@@ -939,7 +943,14 @@ function agents-vault --description 'track curated agent memory in a host-scoped
         # idempotent and makes its own parent directories, so there is
         # nothing this guard would protect that the helper does not already
         # handle on its own.
-        set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem")
+        #
+        # 2>/dev/null: a command substitution's stderr does not inherit a
+        # caller-scoped redirect on this call (fish quirk -- proven with a
+        # two-line repro: `outer 2>/dev/null` where outer does `set -l x
+        # (inner)` still leaks inner's stderr to the real terminal). The
+        # raw message below is always redundant: failure is re-announced on
+        # $link_rc below in this function's own voice.
+        set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem" 2>/dev/null)
         set -l link_rc $status
         if test $link_rc -ne 0
             echo "$c_err""agents-vault: could not link $live$c_reset" >&2
@@ -973,7 +984,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped
     if not set -q _flag_link
         set -l msg "chore: sync agent memory vault"
         test $did_init -eq 1; and set msg "chore: initialize agent memory vault"
-        set -l sync_out (_agents_repo_sync "$vault" "$msg")
+        # 2>/dev/null: command-substitution stderr bypasses this call's
+        # caller-scoped redirect (see the _agents_repo_ensure_symlink calls
+        # above for the proof); the raw message is redundant with the
+        # $sync_rc-driven echoes just below.
+        set -l sync_out (_agents_repo_sync "$vault" "$msg" 2>/dev/null)
         set -l sync_rc $status
         if test $sync_rc -eq 2
             echo "$c_err""agents-vault: unresolved rebase in the vault; nothing committed$c_reset" >&2