ci(ai-validation, sagitta): follow-up — uniform rm -rf + wipe .venv + drop stray quote escape

Sagitta merge of #1992 landed BEFORE the 3 follow-up Copilot/CR findings
on the same wave were addressed. This PR brings sagitta back to
byte-identity with rolling (PR #1990) and circinus (PR #1991) — same 3
fixes that those PRs got via their second-round commit:

  1. (CR on #1991) Switch wipe step to use `rm -rf` uniformly for all
     reserved paths. `rm -f` silently no-ops on directories; a fork
     could commit `pass1-findings.json/` AS a directory and bypass the
     wipe.

  2. (Copilot on #1991) Add `.venv` to the wipe list.
     astral-sh/setup-uv with activate-environment:true creates
     ${{ github.workspace }}/.venv and prepends its bin/ to PATH; a
     fork-pre-populated .venv/bin/ could poison PATH for subsequent
     steps.

  3. (Copilot on #1992) Replace literal `PR"\'"\'"s` (a stray shell
     heredoc escape) with plain `PR's` in the inline comment block.

No behavioural change beyond the three fixes; sagitta now matches the
post-follow-up state of rolling/circinus.

0 files changed, 0 insertions, 0 deletions