refactor: migrate endpoints.py do_roadblock() to toolbox's shared implementation

[k-rister]

Summary

PERFNFV-462 — migrate endpoints.py's do_roadblock() to toolbox's shared implementation

• endpoints.py maintained its own independent do_roadblock() (~110 lines, direct roadblock class instantiation) that diverged from toolbox.roadblock.do_roadblock — the implementation engine_lib.py already uses. Bug fixes to one weren't guaranteed to reach the other.
• Migrated endpoints.py's do_roadblock() to a thin wrapper delegating to toolbox.roadblock.do_roadblock, keeping only the endpoint-specific pre-connect ping diagnostic and message-stream logging on top. Function signature unchanged, so no call site (endpoints.py, kube.py, remotehosts.py) needed updating.
• The other half of PERFNFV-462 — consolidating the duplicated ROADBLOCK_EXITS dict between toolbox's messages.py and roadblock.py — was already fixed by a prior toolbox commit (b9b5a6d), so no toolbox changes are included here.
• Added the first unit tests for endpoints.py's do_roadblock() (tests/test_endpoints_do_roadblock.py), mocking out toolbox/roadblock/fabric/invoke/paramiko via the existing SourceFileLoader pattern since CI doesn't check those out for this job.

PERFNFV-468 — gate crucible-ci on rickshaw's own unit tests

• Adopts the same local-reusable-workflow gate pattern already proven on toolbox (PR#130): unittest.yaml becomes workflow_call-only, and crucible-ci.yaml's new call-unittest job runs it first, using the exact same if: condition as call-real-core-release-crucible-ci, added to both call-real's and crucible-ci-complete's needs:.
• Unlike toolbox, rickshaw already had a standalone unittest.yaml whose unittest-complete job ran in parallel with, not gating, the expensive crucible-ci integration matrix. Removed that standalone trigger and its changes/faux-unittest/unittest-complete jobs entirely — crucible-ci.yaml's own changes/faux-path logic already covers the docs-only fast path.
• Live repo-settings change: updated rickshaw's default-branch-required branch-protection ruleset to drop unittest-complete from required status checks (it can no longer report, since the workflow that produced it is gone), leaving crucible-ci-complete as the sole required check. Confirmed via the toolbox rollout that this is sufficient, since crucible-ci-complete transitively depends on the new gate. Synced .github/rulesets/branches/default-branch-required.json (documentation snapshot only) to match.
• Also removed unittest.yaml from crucible-ci.yaml's own changes job skip-file list — it's the actual test payload now that it's wired into the gate, so a PR that only breaks the test-runner itself shouldn't be classified as docs-only and skip validating that exact breakage.

Refs: PERFNFV-462, PERFNFV-468

Test plan

• pytest -v tests/*.py — 15/15 passing (9 pre-existing + 6 new)
• py_compile clean
• Verified via real import against the actual toolbox/roadblock repos on disk that the signature and missing-label ValueError guard still work
• Mutation-tested the new suite (temporarily broke the hardcoded redis_server value) to confirm it actually fails on regressions, not just passes trivially
• Confirmed no call site passes wait_for today (grepped all three call sites), so the signature-preserving wrapper approach has zero blast radius on callers
• yaml.safe_load clean on both modified workflow files
• Confirm this PR's own live CI run shows call-unittest gating call-real-core-release-crucible-ci, and that crucible-ci-complete is the only check GitHub is waiting on

🤖 Generated with Claude Code