Archive sanitized CI failures and prove failed gates block release

[wsdt]

Summary

• Failed jobs previously left no sanitized failure artifact. Save a bounded status receipt for seven days while preserving the original failed check.
• Prove the failure path with a separate deliberately failing fixture branch. The fixture never enters this PR or the published immutable prerelease.

Review guide

• Start with .github/workflows/check.yml, scripts/ci-failure-summary.mjs and its three tests.
• The receipt permits only a validated public SHA/event, the running Node version, declared host/runner pins and ten fixed stage outcomes. It excludes raw output, names, prompts, paths and arbitrary environment fields. The pinned upload action receives one exact JSON path.
• Runtime, helper, artwork, manifests and published release assets are unchanged. This PR does not publish another package or move the release tag.

Validation

Checks run

• Local Node suite: 18 passed. Final targeted receipt tests: 3 passed, including malicious input redaction, failed/skipped/unrun distinctions, and strict SHA/version metadata boundaries. Final current-head remote Node suite: 19 passed.
• npm run format:check, YAML formatting/parser check and git diff --check: passed.
• Normal remote workflow: https://github.com/wavect/ernesto/actions/runs/38486006108 passed all format, Node, host, strict validation, audit, package and whitespace gates.
• Deliberately failing fixture: https://github.com/wavect/ernesto/actions/runs/38484376094 failed at npm test with exactly one expected failure among 19 tests. Later host/package gates remained skipped; the workflow stayed failed.
• Downloaded failure artifact: 505 bytes, exact permitted schema, test failure and downstream skipped statuses, no raw/private fields. Both summary creation and artifact upload passed. Temporary remote fixture branch was removed after verification.

Checks not run

• Local host/UI rerun for these CI-only edits: runtime/helper unchanged; normal remote CI executes the host suite. Published-release installation and fresh UI were independently verified separately.
• Hugo, locale and website checks: inapplicable to this public mod CI change. This repository has no docs:check script.

Manual or remote verification

The controlled fixture is commit acfb89ccfe02f45bddf6bc83abb9e4a9417df44e. The downloaded summary SHA256 is 4ec9460da88362dd93b4d891f09a45c20580c7d98cd61cf04522db6322846ce8. It records Node24.3.0, Claude Code pin2.1.296 and Vitest pin4.1.11. A skipped host stage is never represented as a passing test.

Current head a952f7469d4bd34bb2650a5aab3ce8fa61fca9dd has both exact-head checks successful and is mergeable: push, PR.

Impact

• Developer behavior: failed CI provides a minimal diagnostic receipt without weakening gates.
• Affected build stages: failure reporting/upload and script formatting coverage.
• Affected locales: none.
• Generated files and downloaded receipts remain ignored; no cache or raw logs are committed.

Risk and recovery

• Upload failure leaves the job failed. The exact path prevents collecting the entire hidden cache.
• Revert this CI-only change to restore previous failure reporting. The immutable released code/assets remain unchanged.
• Merge only after current-head checks pass; no automatic merge or release action is included.

Author checklist

• Complete base-relative branch diff reviewed.
• No unrelated changes, secrets, host-specific paths or generated cache files committed.
• Source edited, with runtime and published artifacts preserved.
• Owning contribution documentation updated with actual commands and remote evidence.