Extend scripts/ci/i18n_cjk_guard.py with a third check that fails any
PR introducing a key in only one of locales/en.json / locales/zh.json.
The new check runs alongside the existing CJK-clean and per-path
ratchet checks, with no short-circuit and the same single-exit-code
contract; the workflow file and CLI flags are untouched.
Live catalogues are already parity-clean (962 keys per side), so the
guard ships green. This addresses acceptance criterion 4 of the
English-support epic ("for every externalized log message, matching
log.* keys exist in both locales/en.json and locales/zh.json") with a
permanent automated guard, complementing the CJK-clean ratchet from #26.
Refs #11
a7eab1eea1