CI, review use of after_script

Apparently after_script is strange. It seems like it probably doesn't do what we want, or, at least, what our use of it would seem to imply. See tpo/tpa/team#41323 (closed).

We should review our .gitlab-ci.yml's uses of after_script in the light of this information, and the gitlab docs (also linked to in that other ticket).