fix(ci): stop CI Report dying silently when the tests job fails

The "Build report" step in ci-report.yml runs under
`bash --noprofile --norc -e -o pipefail`. It located its inputs with

    UNIT_SUMMARY=$(find "$DIR/test-reports" -name ... 2>/dev/null | head -1)

`coverage-merge` in ci-tests.yml is `needs: tests` with no `if: always()`,
so any failing shard skips it and the `test-reports` artifact is never
uploaded. `find` then runs against a directory that does not exist and
exits 1; `-o pipefail` carries that status through `| head -1`, the
command substitution hands it to the assignment, and `-e` kills the step.

The death is invisible: `2>/dev/null` discards find's error and the whole
report is built into `$GITHUB_OUTPUT`, so the step logs nothing and just
reports "Process completed with exit code 1". "Comment on PR" is then
skipped, so the CI Report workflow fails and posts nothing on exactly the
PRs whose tests failed — when the report is most useful. The
"Coverage data unavailable" fallback already existed for this case but
was unreachable, because the script died ~160 lines before it.

Route the four lookups through a `find_first` helper that returns empty
when the root is absent. Verified by extracting the step body and running
it against both artifact layouts: with `test-reports` present the output
is byte-identical to the previous script (1335 bytes), and with it absent
the step now exits 0 and emits the coverage-unavailable report instead of
exiting 1 with an empty $GITHUB_OUTPUT.

Observed on 32 of the last 100 failed runs; correlation with the tests
job's conclusion was 6/6 failure and 4/4 success in the sampled runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci-report.yml

@@ -256,21 +256,37 @@ jobs:
             fi
           }
 
+          # ── Helper: first matching file, tolerating an absent root ──
+          # `coverage-merge` (ci-tests.yml) is `needs: tests` with no
+          # `if: always()`, so a failing shard skips it and the `test-reports`
+          # artifact is never uploaded.  A bare `find` on the missing directory
+          # exits 1; `-o pipefail` carries that through `| head -1` and `-e`
+          # then killed this step — silently, because stderr is discarded and
+          # stdout is redirected to $GITHUB_OUTPUT.  That skipped "Comment on
+          # PR" and failed the run precisely when a PR had failing tests, which
+          # is when the report matters most.  Degrade to "" instead so the
+          # coverage-unavailable fallback below can do its job.
+          find_first() {
+            local root=$1 name=$2
+            [ -d "$root" ] || return 0
+            find "$root" -name "$name" -type f 2>/dev/null | head -1 || true
+          }
+
           # ── Read coverage reports ──
-          UNIT_SUMMARY=$(find "$DIR/test-reports" -name "coverage-summary.json" -type f 2>/dev/null | head -1)
+          UNIT_SUMMARY=$(find_first "$DIR/test-reports" "coverage-summary.json")
 
           read_cov "U" "$UNIT_SUMMARY"
 
           # ── Read base branch coverage (main) ──
           BASE_SUMMARY=""
           if [ "$BASE_FOUND" = "true" ] && [ -n "$BASE_DIR" ]; then
-            BASE_SUMMARY=$(find "$BASE_DIR/base" -name "coverage-summary.json" -type f 2>/dev/null | head -1)
+            BASE_SUMMARY=$(find_first "$BASE_DIR/base" "coverage-summary.json")
           fi
           read_cov "B" "$BASE_SUMMARY"
 
           # ── Locate test results ──
-          RESULTS_FILE=$(find "$DIR/test-reports" -name "test-results.json" -type f 2>/dev/null | head -1)
-          WEB_RESULTS_FILE=$(find "$DIR/test-reports" -name "web-test-results.json" -type f 2>/dev/null | head -1)
+          RESULTS_FILE=$(find_first "$DIR/test-reports" "test-results.json")
+          WEB_RESULTS_FILE=$(find_first "$DIR/test-reports" "web-test-results.json")
 
           sum_results() {
             local file=$1