Changes

ci(security): add regression presubmit for credential policy checks (#4546)

## Summary
Continue phased delivery after PR #4541 (remaining scope):
- add regression test script
`.ci/test-verify-jenkins-credential-policy.sh`
- add new presubmit `pull-test-security-policy-scripts` to run these
tests automatically
- document the new regression gate in `docs/guides/CI.md`

## Why
The earlier phase introduced credential policy checks. This PR adds
positive/negative regression coverage so policy rules are stable and
safe to evolve.

## Test
- `bash -n .ci/test-verify-jenkins-credential-policy.sh`
- `bash .ci/test-verify-jenkins-credential-policy.sh`
 (commit: fe7117f)