[ilanh]

Closes #83

The first manual run of the openshell-next workflow (42636278277) went green while doing nothing: the branch has no copy of the scripts, and | tee hid the failures.

Changes

• defaults: run: shell: bash in openshell-next.yml runs every step with -eo pipefail, so the redundant set -o pipefail in the test step is gone. I checked the other workflows for the same | tee problem: composite actions already set shell: bash, ci.yml and upstream-compat.yml don't pipe into tee (upstream-compat.sh checks PIPESTATUS), and the pipes in release.yml sit inside if/|| checks that fail correctly.
• The tooling always comes from main. A new step copies scripts/openshell-next.sh and scripts/openshell-tags.sh to $RUNNER_TEMP/tools before checking out openshell-next, then runs them against the checkout with OPENSHELL_ANNOTATE_ROOT=$GITHUB_WORKSPACE. Both scripts now honor that env var; openshell-next.sh passes it on to openshell-tags.sh and calls it by absolute path. A fix to the scripts now applies on the next run.
• The report reflects reality.
  • It reads the pin from the checkout, falling back to the bump output and then to the pin at checkout, so it no longer shows unknown.
  • It adds a "Pin update" row and a ❌ in the heading when any step failed, plus a tail of the bump log when the bump fails.
  • tail of a missing log no longer aborts the comment under -e.
  • The final step fails the run on a bump failure too, with always().
• Docs: docs/DEVELOPING.md describes the main-tooling and pipefail behaviour and OPENSHELL_ANNOTATE_ROOT, and CHANGELOG has a new line. The AGENTS.md mapping row and RELEASING are unchanged because nothing they describe changed. gen-actions-docs.sh --check passes; the composite actions are untouched.

Verified (on nemoclaw, in a temp clone)

• actionlint 1.7.7 is clean, and shellcheck 0.10.0 is clean on openshell-{next,tags}.sh and upstream-compat.sh.
• The scenario that failed: I ran main's scripts from a temp dir against a checkout of origin/openshell-next (cea9e1e, no scripts).
  • sync origin/main merged cleanly.
  • update moved the pin from v0.1.8-pre.3 to the newly tagged v0.1.8-pre.4.
  • On pre.4, fmt, clippy -D warnings, cargo test --locked, gen-docs.sh --check and gen-actions-docs.sh --check all pass.
• The report step, extracted from the YAML and run with bash -eo pipefail and a stubbed gh:
  • Bump failure: heading ❌, "Pin update ❌ failed", log tail, pin v0.1.8-pre.3.
  • Forced report with no change: "already on the newest tag".
  • Merge and tests failed with no logs: the comment is still posted ("(no log captured)"), with exit 0.

After this merges, one manual run should merge main into openshell-next, move it to v0.1.8-pre.4, push, dispatch CI on #82 and post a real comment on #80.