chore(blocking-io): fail-loud repo-root resolution and shared detector CLI shim (#3512)

* chore(blocking-io): fail-loud repo-root resolution and shared detector CLI shim

The three detectors resolved REPO_ROOT with depth-indexed
Path(__file__).resolve().parents[4]. If a detector file ever moves to a
different directory depth, scan roots resolve under the wrong directory
and the detector reports zero findings with no error — a silent-zero
failure shape for a detection tool.

- Add support/detectors/repo_root.py: resolve the repo root by walking
  upward to the .git marker (checked with exists() so git worktrees,
  where .git is a file, also resolve), raising RuntimeError when no
  marker is found. All three detectors use it at import time, so a
  relocated detector fails loudly instead of scanning an empty tree.
- Extract scripts/_detector_cli.py from the three character-identical
  CLI shims; the sys.path computation lives in one place and raises
  when backend/tests cannot be found.
- tests/test_detector_repo_root.py pins: resolution from an unmarked
  location raises instead of returning an empty scan; all three
  detectors share the resolved root; each CLI shim delegates to its
  detector.

Testing: backend `make test` (4278 passed); smoke-ran
`make detect-blocking-io`, `make detect-thread-boundaries`, and
`scripts/scan_changed_blocking_io.py --base upstream/main`.

Closes #3510 (review follow-up to #3503).

* chore(blocking-io): declare detector modules import-only, drop script-mode residue

Adversarial review caught that blocking_io_static.py and
thread_boundaries.py kept shebangs and __main__ blocks but can no longer
run as plain scripts: the new `from support.detectors.repo_root import`
executes before anything puts backend/tests on sys.path, so direct
invocation dies with ModuleNotFoundError before argparse.

Direct execution was never a documented entry point (Makefile targets,
the scripts/ shims, the blocking-io-guard skill, and tests all go
through the support.detectors package), so converge on import-only
instead of re-adding per-module bootstrap: drop the shebangs and the now
unreachable __main__ blocks (plus the `import sys` they kept alive) and
state the supported entry points in each module docstring. The shim
delegation tests in test_detector_repo_root.py pin the supported CLI
paths.

Testing: backend `make test` (4278 passed); `make detect-blocking-io`
and `make detect-thread-boundaries` smoke-ran.

scripts/_detector_cli.py

@@ -0,0 +1,27 @@
+"""Shared bootstrap for the detector CLI shims in this directory.
+
+The detectors live under `backend/tests/support/detectors/` so they can be
+exercised by the test suite; the shims here only put that package on
+`sys.path` and delegate. Keeping the path computation in one place means a
+layout change breaks loudly in exactly one file instead of silently drifting
+across copies.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+
+TEST_SUPPORT_PATH = Path(__file__).resolve().parents[1] / "backend" / "tests"
+
+
+def run_detector(module_name: str, argv: Sequence[str] | None = None) -> int:
+    """Import a `support.detectors.*` module and run its `main(argv)`."""
+    if not TEST_SUPPORT_PATH.is_dir():
+        raise RuntimeError(f"detector support path not found: {TEST_SUPPORT_PATH}; the scripts/ directory has moved relative to backend/tests")
+    if str(TEST_SUPPORT_PATH) not in sys.path:
+        sys.path.insert(0, str(TEST_SUPPORT_PATH))
+    module = importlib.import_module(module_name)
+    return module.main(argv)