Badge builders should fail loud on unknown status instead of coercing to 'failing'

[monsieurleberre]

From the pre-open review of #23. Two helpers silently coerce unrecognized input to a plausible-but-wrong value instead of erroring (violates no-silent-failure):

• scripts/matrix_badge_json.py parse_passed returns True only for an allowlist; anything else → False → red 'failing' badge. A cancelled/skipped/typo'd status renders a misleading red badge.
• scripts/aggregate_matrix_status.py read_marker treats a malformed/empty marker (no status) as passed: false rather than raising.

Since write-badges.sh passes .passed as a JSON bool, tighten both to reject values outside the known set and fail loud, mirroring coverage_badge_json.py's strict integer parsing. Add tests for the rejected cases.