CI review fixes: JSON validation, log volume, rm -rf, flag spelling

Address the Copilot review:
- parallel-make-check.py: validate "configure" (list of strings) and
  cflags/ldflags (strings) so a malformed entry fails the load instead
  of exploding a string into per-character configure arguments; print
  a single line for passing configs instead of dumping their full
  make-check.log into the CI log (failure dumps unchanged; the logs
  remain in build-<name>/ for the failure artifacts).
- Makefile.am: use rm -rf for the certs/input/quit setup and distclean
  cleanup. A --private-dir run replaces the certs symlink with a
  private directory copy that rm -f cannot remove (verified: make
  distclean in a build dir with a privatized certs/ now succeeds and
  removes it).
- psk.yml, disable-pk-algs.yml: normalize the single-dash tokens
  (-disable-rsa, -disable-ecc, -disable-aescbc, -enable-cryptonly)
  carried verbatim from the old matrices to the canonical double-dash
  form. No coverage change: configure honors single-dash spellings
  (verified -disable-rsa sets NO_RSA with no unrecognized-option
  warning), so these were always in effect; both touched configs
  re-validated end-to-end.

The --cc default stays "ccache gcc": ccache resolves the compiler
through its own masquerade symlinks (verified: no recursion and normal
cache hits with /usr/lib/ccache prepended to PATH), and the explicit
CC= also covers jobs that use ccache without the PATH masquerade.

.github/scripts/parallel-make-check.py

@@ -142,6 +142,14 @@ def load_configs(opts, error):
                   f"directory suffix: {entry!r}")
         if any(cfg.name == name for cfg in configs):
             error(f"{opts.json}: duplicate config name {name!r}")
+        configure = entry.get("configure", [])
+        if not (isinstance(configure, list)
+                and all(isinstance(a, str) for a in configure)):
+            error(f"{opts.json}: \"configure\" must be a list of argument "
+                  f"strings in {name!r}")
+        for key in ("cflags", "ldflags"):
+            if not isinstance(entry.get(key, ""), str):
+                error(f"{opts.json}: \"{key}\" must be a string in {name!r}")
         minutes = entry.get("minutes", 1.0)
         if isinstance(minutes, bool) or not isinstance(minutes, (int, float)) \
                 or minutes < 0:
@@ -165,7 +173,7 @@ def load_configs(opts, error):
                             for cmd in cmds)):
                 error(f"{opts.json}: \"{key}\" must be a list of argv lists "
                       f"in {name!r}")
-        configs.append(Config(name, list(entry.get("configure", [])), cc,
+        configs.append(Config(name, list(configure), cc,
                               entry.get("cflags", opts.cflags),
                               entry.get("ldflags", opts.ldflags),
                               float(minutes), user_settings, check,
@@ -273,9 +281,13 @@ def run_config(cfg, opts):
         if failed == "aborted":
             print(f"{cfg.name}: aborted (fail-fast) [{minutes:.1f} min]")
             sys.stdout.flush()
+        elif not failed:
+            # One line per passing config; the full logs would bloat the CI
+            # log (they stay in build-<name>/make-check.log).
+            print(f"{cfg.name}: pass [{minutes:.1f} min]")
+            sys.stdout.flush()
         else:
-            verdict = f"FAIL ({failed})" if failed else "pass"
-            dump(f"{cfg.name}: {verdict} [{minutes:.1f} min]", log)
+            dump(f"{cfg.name}: FAIL ({failed}) [{minutes:.1f} min]", log)
             if failed == "configure":
                 dump(f"{cfg.name}: config.log", bdir / "config.log")
             elif failed == "make check":