Repair test-report tooling - #9321

The Test Report workflow has been broken since the CI migration to pixi (dask#9276):

- Run the report generation through a new, self-contained `test-report` pixi
  environment: `pixi run test-report dask/distributed`.
  Delete the unused conda environment file.
- Adapt job/artifact name parsing in test_report.py to the names produced by
  the post-pixi tests.yaml, in both dask/distributed and dask/dask. Runs older
  than 2026-06-04 cannot be parsed and are skipped.
- Replace the unmaintained altair_saver with altair>=6 native HTML output.
- Fix regression introduced by the f-string conversion in dask#9245 which
  collapsed all tests into a single unreadable chart.
- Name the local artifact caches after the repo (e.g.
  test_report_dask__distributed) so that reports for multiple repos can be
  generated from the same working directory.
- Fall back to `gh auth token` when GITHUB_TOKEN is not set.
- On PRs, run the workflow only when the `test-report` label is set; upload
  the reports and databases as workflow artifacts instead of deploying to
  GitHub Pages.
- Fix actions/cache usage so that the database cache is actually updated on
  every run (cache keys are immutable).
- Skip in-progress and expired runs/artifacts to avoid poisoning the cache.

Co-Authored-By: Claude Fable 5 <[email protected]>

The explicit permissions block removes the default actions:read scope, which
is needed to list workflow runs and download artifacts. The PR run passed
regardless because fork PR tokens are read-only on all scopes.

Co-Authored-By: Claude Fable 5 <[email protected]>

Each job gets strictly the permissions it needs: generate gets actions:read
(plus contents:read for checkout), deploy gets contents:write. The report is
handed over between the jobs as a workflow artifact, which also becomes
always available for debugging; the databases are only uploaded on PRs.

Co-Authored-By: Claude Fable 5 <[email protected]>