Harden write-badges.sh: surface git-fetch errors, guard malformed matrix entries, add tests

[monsieurleberre]

Follow-ups from the pre-open review of #23 (badges feature). The happy path is live-tested and works; these are no-silent-failure hardening items on scripts/write-badges.sh.

• fetch error masking — git fetch origin "$badge_branch" || true swallows all failures (auth/network), not just the benign "branch doesn't exist yet" case, then silently falls through to the orphan-rebuild path. Mitigated today because the non-force git push rejects a non-fast-forward (fails loud), but it still violates our no-silent-failure rule. Fix: guard with git ls-remote --exit-code origin refs/heads/$badge_branch and only fetch when the ref exists (let a real fetch failure abort).
• matrix loop null-guard — the coverage loop skips empty/null percent, but the matrix loop has no equivalent guard, so a malformed matrix-data entry would write ci-null-null-null.json. Mirror the coverage-loop guard (skip or, better, error).
• tests — write-badges.sh has no test, yet it owns the null-skip and the coverage-<slug>.json / ci-<lang>-<os>-<arch>.json filename contract that the README badge URLs depend on. Add a bats or python-subprocess test pinning the produced filename set and the null-skip behavior.