pr-review-cli: a failed publish leaves the status check green #867

Problem

In pr-review-cli.yml (v0.63.1), a failed publish leaves the lane's status check green. The review ran, but no review, summary or marker reached the PR.

Seen on claude-code-plugins#9307 at head d714aaa. The publish step failed with "API rate limit exceeded for installation" (failure-class=publish-failed), and the status check still concluded success (job 120258309454 annotations). Re-running the job published normally.

The caller's revert rule (revert on a red status, or on no summary posted for a head, twice in a row) relies on a missing summary showing as a red check. Babysit reads a green check plus a missing record as no-record, which holds the PR. So nothing merges wrongly, but the hold carries no reason a person can see.

Fix

The status job fails, naming publish-failed, whenever the publish step did not finish. Optionally, retry the publish on a rate-limit error with script backoff before failing. Add a test: a forced publish failure ends the status job red.