ci.yml: two shellcheck findings in the ASan receipt steps (SC2010 ls|grep count, SC2129 redirects) #1791

Found while running actionlint -shellcheck locally for PR #1785. Both findings are on main today (line numbers at e48c4a0e). Nothing in CI runs actionlint, so nothing reports them.

1. .github/workflows/ci.yml:986, step "Require one receipt per shard, and a summed leak tally of zero". SC2010 (warning): found=$(ls shard-receipts 2>/dev/null | grep -c . || true) counts the receipts by parsing ls. A glob, or find shard-receipts -maxdepth 1 -type f | wc -l, counts the same files without parsing ls.
2. .github/workflows/ci.yml:1145, step "Write the shard receipt". SC2129 (style): the receipt is built from separate >> shard-${{ matrix.shard }}.txt redirects. One { ...; } > shard-${{ matrix.shard }}.txt group writes it in one place.

The first is the ASan receipt aggregator, a gate: the change must keep it failing closed.

Done when

• actionlint -shellcheck shellcheck .github/workflows/ci.yml reports neither SC2010 nor SC2129.
• The receipt count still fails closed. With one receipt missing, or one extra file in shard-receipts/, the aggregator step exits 1. Both planted faults are recorded in the PR.
• The PR's gate self-tests (changed rows) check passes. A ci.yml change selects tools/section_plan.sh --selftest and tools/asan_receipts_check.sh --selftest.