ci(openshell-next): workflow passes while doing nothing (scripts missing on branch, no pipefail) #83

The first manual run of .github/workflows/openshell-next.yml after #81 merged (run 42636278277) went green but did nothing. Its comment on #80 (16:38 Israel time) is a false pass, with the pin shown as unknown.

Bug 1: the scripts are missing on openshell-next

The workflow checks out openshell-next and then runs scripts/openshell-next.sh from that checkout. The branch was cut before #81, so it has no copy of the script. Both the "Merge main" and "Bump" steps failed with scripts/openshell-next.sh: No such file or directory. The branch also would always run its own, possibly stale, copy of the tooling rather than main's.

Bug 2: missing pipefail hides the failures

Without an explicit shell:, GitHub runs steps with bash -e {0}, which has no pipefail. So scripts/openshell-next.sh sync ... | tee sync.log and ... update | tee succeeded even though the script failed. Only the test step had its own set -o pipefail. As a result, the report saw success for every step and couldn't read the pin, so it showed unknown. Nothing was pushed, so openshell-next is still at cea9e1e (v0.1.8-pre.3) and 1 behind main, while upstream has since tagged v0.1.8-pre.4.

Fix

• Set defaults: run: shell: bash (-eo pipefail) in the workflow. I checked the other workflows and composite actions: the composite steps all set shell: bash, and the remaining pipes in release.yml are inside checks that fail correctly.
• Copy main's openshell-next.sh and openshell-tags.sh to a temp dir before checking out the branch, and run them against the checkout through a new OPENSHELL_ANNOTATE_ROOT env var.
• In the report, show every failed step, including the bump, read the pin from the checkout, and survive missing logs. Fail the run when the bump fails.