Annotate failing tests in the test legs

The macOS and Windows `test` legs (merge queue, main, nightly) and
`test-release` only leave "Process completed with exit code 1" when a
test fails. The panic sits thousands of lines above the end of the
log, past the 5,000-line tail the log API returns, so a failure can't
be diagnosed after the fact. The 2026-10-30 nightly lost
e2e_golang_workspace_build on macOS this way.

Tee each leg's output and run scripts/ci-test-failures.py on failure,
as `coverage` already does, so each failing test's panic becomes an
annotation and lands in the job summary. Exit status is unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011f9aeNzimDA4mfWzq1NoZa

Author: claude

.github/workflows/ci.yml

@@ -568,8 +568,16 @@ jobs:
           TEST_SHARD: ${{ matrix.shard }}
         # This leg's share of `cargo test --workspace --no-fail-fast`; the
         # shards together run exactly that selection (test_ci_test_shard.py).
+        # A failing test's panic becomes an annotation, as in `coverage`
+        # (scripts/ci-test-failures.py).
         run: |
-          python3 scripts/ci-test-shard.py "$TEST_SHARD" 2
+          set -o pipefail
+          python3 scripts/ci-test-shard.py "$TEST_SHARD" 2 \
+            2>&1 | tee "$RUNNER_TEMP/tests.log" || {
+            status=$?
+            python3 scripts/ci-test-failures.py "$RUNNER_TEMP/tests.log" || true
+            exit "$status"
+          }
 
   test-release:
     # Each PR and main push runs the complete release-mode suite. The merge
@@ -620,7 +628,15 @@ jobs:
         env:
           TEST_SHARD: ${{ matrix.shard }}
           TEST_SHARD_COUNT: ${{ strategy.job-total }}
-        run: python3 scripts/ci-test-shard.py "$TEST_SHARD" "$TEST_SHARD_COUNT" --locked --profile ci-release
+        # Failing tests' panics become annotations, as in `test`.
+        run: |
+          set -o pipefail
+          python3 scripts/ci-test-shard.py "$TEST_SHARD" "$TEST_SHARD_COUNT" --locked --profile ci-release \
+            2>&1 | tee "$RUNNER_TEMP/tests.log" || {
+            status=$?
+            python3 scripts/ci-test-failures.py "$RUNNER_TEMP/tests.log" || true
+            exit "$status"
+          }
 
   coverage:
     if: ((github.event.pull_request.draft != true) && needs.release-readiness.outputs.pr_unchanged != 'true') && (inputs.os != 'windows' && inputs.os != 'macos')