chore(lint): classify scripts/test_first_remediation.py as production and document the sync_orchestrator ssh gap #16514

Problem

Sub-issue of #16179. Two of its five acceptance criteria are still open:

• scripts/test_first_remediation.py matches the test_*.py naming convention check_git_toplevel_env_scrubbed.py's is_production_path() uses to decide "this is a test, skip the production review" — but it is a real operational CLI tool with 11 git callers, not a pytest fixture. pytest.ini never collects it. check_git_write_env_scrubbed.py already carries an ALLOWLIST entry recognizing this for its own (test-write) purposes; the production-code checker had no equivalent.
• autobot-slm-backend/services/sync_orchestrator.py:392 runs git over SSH (argv[0] == "ssh"), which is outside _names_git's reach by design — true, but nowhere recorded, so the next reader has to re-derive it rather than read it.

Scope

Only these two documentation/classification fixes. Not in scope (left on #16179): a regression test pinning each of the seven originally-unscrubbed call sites so a revert is caught — those sites route through different mechanisms (some through the start_git/run_git canonical wrappers, one through a raw asyncio.create_subprocess_exec with an explicit env=strict_git_env()), and a reliable per-site test needs to account for each shape rather than one generic check. That's real, separate work.

Acceptance criteria

• check_git_toplevel_env_scrubbed.py's is_production_path() classifies scripts/test_first_remediation.py as production, via a narrow named override (not a change to the general test_* heuristic)
• A test pins the override for that one file, and a contrast test proves an ordinary test_*.py file still classifies as non-production
• The module's KNOWN GAPS docstring records sync_orchestrator.py:392's ssh case as a stated boundary