fix(ci): pipefail before every | tee, API base from GITHUB_API_URL (#751)

No workflow sets `shell:`, and GitHub runs such a step as `bash -e {0}`,
without pipefail: the exit code of `… | tee` is tee's, and a failing left
side passed silently. Three steps were unprotected:
- _process-resume.yml: an exception of process-resume.mjs (gh, API) left the
  step green and the resume event was lost until process-reconcile;
- release-review.yml: a failed `prepare` went on with an incomplete
  GITHUB_OUTPUT and proceed=true;
- validate.yml: a failed `classify-changes.mjs --heavy` left `heavy` empty,
  heavy jobs were skipped and job `changes` stayed green.
Each gets `set -o pipefail` as the first line of `run` (validate.yml's step
becomes a block), following #727 and #472. test/workflow-pipefail.test.mjs
walks every .github/workflows/*.yml: a `| tee` line in `run` must follow
`set -[a-z]*o pipefail` or the step must have `shell: bash`; on the old tree
it names exactly the three places, and the _process-resume and validate
steps run on real bash under `bash -e` with a failing node.

ci-proof.mjs exports githubApiBase(env) (GITHUB_API_URL or
https://api.github.com, no trailing slash); githubCandidateTree,
loadGithubProofContext and release-gate's workflowRunsUrl take `apiBase`
with that default instead of the hardcoded host. night-red.mjs passes the
base directly and drops the fetch wrapper that rewrote the prefix. On
github.com the runner's GITHUB_API_URL is the same host, so behaviour there
does not change; archive_download_url stays as the API returned it.

The `mode` input for ship-review is out of scope (thin file in main, #716).
Thin files are not touched: _process-resume.yml is a body, validate.yml and
release-review.yml are not thin.

Issue: #751
User-Visible: no
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018qZfe7YS4rqEMKoVeS3GKd

.github/workflows/_process-resume.yml

@@ -54,7 +54,11 @@ jobs:
           SHA: ${{ github.event.workflow_run.head_sha }}
           EVENT: ${{ github.event.workflow_run.event }}
           STATUS: ${{ github.event.workflow_run.status }}
+        # #751: без pipefail код конвейера — код tee, и исключение скрипта (gh,
+        # API) проходило зелёным шагом: событие возобновления терялось до
+        # прохода process-reconcile.
         run: |
+          set -o pipefail
           node scripts/process-resume.mjs \
             --repo="$REPO" --branch="$BRANCH" --sha="$SHA" \
             --event="$EVENT" --status="$STATUS" --apply=true | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/release-review.yml

@@ -75,6 +75,9 @@ jobs:
           FORCE: ${{ inputs.force }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
+          # Отказ prepare за `| tee` не должен идти дальше с неполным
+          # GITHUB_OUTPUT и proceed=true (#751).
+          set -o pipefail
           doc=$(node scripts/release-review.mjs doc --tag="$TAG")
           git fetch -q --tags origin
           if [ -z "$CANDIDATE" ]; then

.github/workflows/validate.yml

@@ -368,7 +368,11 @@ jobs:
           FULL_INPUT: ${{ inputs.full }}
           MUTANTS_INPUT: ${{ inputs.mutants }}
           REF_NAME: ${{ github.ref_name }}
-        run: node scripts/classify-changes.mjs --heavy | tee -a "$GITHUB_OUTPUT"
+        # #751: без pipefail упавший classify-changes оставлял heavy пустым —
+        # тяжёлые job молча пропускались, а job changes зеленела.
+        run: |
+          set -o pipefail
+          node scripts/classify-changes.mjs --heavy | tee -a "$GITHUB_OUTPUT"
       - id: base
         if: github.event_name != 'pull_request'
         env: